[#334] Add auth doc #336

dkirillov · 2024-03-16T09:43:53Z

dkirillov commented

2024-03-16 09:43:53 +00:00

close #334

dkirillov force-pushed feature/334-add_auth_doc from f0a5358139 to 58326b5406

2024-03-16 09:44:49 +00:00

Compare

dkirillov requested review from storage-services-committers 2024-03-16 09:45:36 +00:00

dkirillov requested review from storage-services-developers 2024-03-16 09:45:38 +00:00

dkirillov force-pushed feature/334-add_auth_doc from 58326b5406 to 5f5eb72605

2024-03-18 11:55:18 +00:00

Compare

alexvanin reviewed 2024-03-20 12:18:48 +00:00

docs/authentication.md Outdated

					
				@ -0,0 +267,4 @@

				    * If no rules were matched return `deny` status.

				To local and contract policies `deny first` scheme is applied. This means that if several rules were matched for

				reqeust (with both statuses `allow` and `deny`) the resulting status be `deny`.

alexvanin commented

2024-03-20 12:18:48 +00:00

Add a little more details about the way S3 Gateway creates request context to pass it to APE.

alexvanin marked this conversation as resolved

alexvanin reviewed 2024-03-20 12:36:14 +00:00

docs/authentication.md Outdated

					
				@ -0,0 +88,4 @@

				content to FrostFS S3 directly from the browser. For information about authenticating POST requests,

				see [Browser-Based Uploads Using POST (AWS Signature Version 4)](https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-UsingHTTPPOST.html).

				#### Introduction to Signing Requests

alexvanin commented

2024-03-20 12:36:14 +00:00

This part is focused on the way how request is signed. It is useful for the client, but we want to emphasize here how Gateway validates this signature.

Can we be a bit more explicit down there and in AccessBox section, how gateway uses accessbox fields to re-create signature from the request and compare it. Let's focus more on this process.

This part is focused on the way how request is signed. It is useful for the client, but we want to emphasize here how Gateway validates this signature. Can we be a bit more explicit down there and in `AccessBox` section, how gateway uses accessbox fields to re-create signature from the request and compare it. Let's focus more on this process.

alexvanin marked this conversation as resolved

alexvanin reviewed 2024-03-20 12:39:01 +00:00

docs/authentication.md Outdated

					
				@ -0,0 +119,4 @@

				##### Signature Calculations for the Authorization Header

				o calculate a signature, you first need a string to sign. You then calculate a HMAC-SHA256 hash of the string to sign by