carpawell/frostfs-node
1
0
Fork 0
forked from TrueCloudLab/frostfs-node
Code Issues Pull requests Projects Releases Packages Wiki Activity

Allow Impersonate

Browse source 
Signed-off-by: Alex Vanin <a.vanin@yadro.com>
This commit is contained in:
Alexey Vanin 2022-10-24 16:29:05 +03:00 committed by Denis Kirillov
parent 3d873237d5
commit 56f12c77b9
2 changed files with 11 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
pkg/services/object/acl/acl.go
View file

@ -124,15 +124,17 @@ func (c *Checker) CheckEACL(msg interface{}, reqInfo v2.RequestInfo) error {
return nil return nil
} }
bearerTok := reqInfo.Bearer()
impersonate := bearerTok != nil && bearerTok.Impersonate()
// if bearer token is not allowed, then ignore it // if bearer token is not allowed, then ignore it
if !basicACL.AllowedBearerRules(reqInfo.Operation()) { if impersonate || !basicACL.AllowedBearerRules(reqInfo.Operation()) {
reqInfo.CleanBearer() reqInfo.CleanBearer()
} }
var table eaclSDK.Table var table eaclSDK.Table
cnr := reqInfo.ContainerID() cnr := reqInfo.ContainerID()
bearerTok := reqInfo.Bearer()
if bearerTok == nil { if bearerTok == nil {
eaclInfo, err := c.eaclSrc.GetEACL(cnr) eaclInfo, err := c.eaclSrc.GetEACL(cnr)
if err != nil { if err != nil {

7
pkg/services/object/acl/v2/request.go
View file

@ -2,6 +2,7 @@ package v2
import ( import (
"crypto/ecdsa" "crypto/ecdsa"
"crypto/elliptic"
"fmt" "fmt"
sessionV2 "github.com/TrueCloudLab/frostfs-api-go/v2/session" sessionV2 "github.com/TrueCloudLab/frostfs-api-go/v2/session"
@ -113,6 +114,12 @@ func (r MetaWithToken) RequestOwner() (*user.ID, *keys.PublicKey, error) {
return nil, nil, errEmptyVerificationHeader return nil, nil, errEmptyVerificationHeader
} }
if r.bearer != nil && r.bearer.Impersonate() {
issuer := bearer.ResolveIssuer(*r.bearer)
pubKey, err := keys.NewPublicKeyFromBytes(r.bearer.SigningKeyBytes(), elliptic.P256())
return &issuer, pubKey, err
}
// if session token is presented, use it as truth source // if session token is presented, use it as truth source
if r.token != nil { if r.token != nil {
// verify signature of session token // verify signature of session token