Support secondary keys in FrostFSID contract #518

New issue

Open

opened 2024-10-17 12:50:03 +00:00 by alexvanin · 0 comments

alexvanin commented

2024-10-17 12:50:03 +00:00

Owner

FrostFSID contract supports multiple additional keys for subject. It means, that single subject may operate with credentials, signed by different private keys. All these credentials must be handled correctly by S3 Gateway.

Authmate

Modify register-user command to attach additional keys in FrostFS ID subject.

Gateway

Rework request authentication to support additional keys:

update ValidatePublicKey to use GetSubjectByKey to look for both primary and additional keys,
during policy check, find primary key based on the signature key and use it later in this function,
(needs to discuss) find primary key of a request signer to set bucket owner
- this is important for this code from Inner Ring

FrostFSID contract supports multiple [additional keys](https://git.frostfs.info/TrueCloudLab/frostfs-contract/src/commit/3f4f8feca799c45e2a74374bf6046758cfd584e9/frostfsid/frostfsid_contract.go#L26) for subject. It means, that single subject may operate with credentials, signed by different private keys. All these credentials must be handled correctly by S3 Gateway. ## Authmate Modify `register-user` command to attach additional keys in FrostFS ID subject. ## Gateway Rework request authentication to support additional keys: * update [ValidatePublicKey](https://git.frostfs.info/TrueCloudLab/frostfs-s3-gw/src/commit/e35b582fe25a97c018367ef9244dfe93d4500ad9/internal/frostfs/frostfsid/frostfsid.go#L55) to use `GetSubjectByKey` to look for both primary and additional keys, * during policy check, find primary key based on the [signature key](https://git.frostfs.info/TrueCloudLab/frostfs-s3-gw/src/commit/e35b582fe25a97c018367ef9244dfe93d4500ad9/api/middleware/policy.go#L172) and use it later in this function, * (needs to discuss) find primary key of a request signer to set [bucket owner](https://git.frostfs.info/TrueCloudLab/frostfs-s3-gw/src/commit/e35b582fe25a97c018367ef9244dfe93d4500ad9/api/handler/put.go#L737) * this is important for [this](https://git.frostfs.info/TrueCloudLab/frostfs-node/src/branch/master/pkg/innerring/processors/container/process_container.go#L183-L188) code from Inner Ring