Support impersonation flag in bearer token #68
Labels
No labels
P0
P1
P2
P3
badger
frostfs-adm
frostfs-cli
frostfs-ir
frostfs-lens
frostfs-node
good first issue
triage
Infrastructure
blocked
bug
config
discussion
documentation
duplicate
enhancement
go
help wanted
internal
invalid
kludge
observability
perfomance
question
refactoring
wontfix
No milestone
No project
No assignees
5 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: TrueCloudLab/frostfs-node#68
Loading…
Reference in a new issue
No description provided.
Delete branch "KirillovDenis/poc/impersonate"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
close #229
Poc/impersonateto WIP: Poc/impersonateBlocked until we create a support branch for the new release.
nns-name
andnns-zone
forcontainer create
88e3868f47strings.Cut
instead ofstrings.Split*
where possible e9f3c24229nnsResolveKey
7486c02bbcgroup.frostfs
key from output of thedump-hashes
9929dcf50bgroup.frostfs
at init step b4582239bfIsLocked
public f006f3b342neo-go
client API for subs 533e9f8b75containersOf
9e54646248containersOf
e85e5382e4alphabetState
param toepochTimer
control shards doctor
commandRandObjGenerator
6ad5c38225DumpShard
andRestoreShard
RPCExists
test stable6218ca502b
to36bc368a3d
36bc368a3d
tode6f94ef9f
WIP: Poc/impersonateto Poc/impersonatePoc/impersonateto Support impersonation flag in bearer tokenJust in case: should the PR have so variable committers list?
@ -61,0 +65,4 @@
if err = bt.Unmarshal(rawBearer); err != nil {
return eACLErr(eaclOp, fmt.Errorf("invalid bearer token: %w", err))
}
if !bt.VerifySignature() {
why check order has been changed? signature verification is more complex thing, i think
@ -179,2 +196,4 @@
}
if bt != nil && bt.Impersonate() {
pub, err = keys.NewPublicKeyFromBytes(bt.SigningKeyBytes(), elliptic.P256())
can we not duplicate
NewPublicKeyFromBytes
andelliptic.P256()
calls in that func?de6f94ef9f
tocd0003cb90
@ -115,1 +116,4 @@
if r.bearer != nil && r.bearer.Impersonate() {
issuer := bearer.ResolveIssuer(*r.bearer)
pubKey, err := keys.NewPublicKeyFromBytes(r.bearer.SigningKeyBytes(), elliptic.P256())
We already unmarshal key inside
ResolveIssuer
and also do it here. Maybe it makes sense to inlineResolveIssuer
?This may be an API issue for SDK as well.
@ -104,0 +106,4 @@
if bt.Impersonate() {
tbCore, err := s.eaclSource.GetEACL(cid)
if err != nil {
if client.IsErrEACLNotFound(err) {
Hm, is gocognit linter happy with this if tower?
cd0003cb90
toc197335b0f
c197335b0f
to0608545f6b
0608545f6b
to700f39c3f8