Revert "pacific: rgw: log access key id in ops logs"

diff --git a/src/rgw/rgw_auth.cc b/src/rgw/rgw_auth.cc
index 919be48ad7c24c28936ddd8781b7bfc39ec8b06d..42fe1133fc9878db5df20d20bf236ce9eefe4089 100644 (file)
--- a/src/rgw/rgw_auth.cc
+++ b/src/rgw/rgw_auth.cc
@@ -11,7 +11,6 @@
 #include "rgw_http_client.h"
 #include "rgw_keystone.h"
 #include "rgw_sal.h"
-#include "rgw_log.h"
 
 #include "include/str_list.h"
 
@@ -459,9 +458,6 @@ bool rgw::auth::WebIdentityApplier::is_identity(const idset_t& ids) const
     return false;
 }
 
-const std::string rgw::auth::RemoteApplier::AuthInfo::NO_SUBUSER;
-const std::string rgw::auth::RemoteApplier::AuthInfo::NO_ACCESS_KEY;
-
 /* rgw::auth::RemoteAuthApplier */
 uint32_t rgw::auth::RemoteApplier::get_perms_from_aclspec(const DoutPrefixProvider* dpp, const aclspec_t& aclspec) const
 {
@@ -613,12 +609,6 @@ void rgw::auth::RemoteApplier::create_account(const DoutPrefixProvider* dpp,
   }
 }
 
-void rgw::auth::RemoteApplier::write_ops_log_entry(rgw_log_entry& entry) const
-{
-  entry.access_key_id = info.access_key_id;
-  entry.subuser = info.subuser;
-}
-
 /* TODO(rzarzynski): we need to handle display_name changes. */
 void rgw::auth::RemoteApplier::load_acct_info(const DoutPrefixProvider* dpp, RGWUserInfo& user_info) const      /* out */
 {
@@ -674,7 +664,6 @@ void rgw::auth::RemoteApplier::load_acct_info(const DoutPrefixProvider* dpp, RGW
 /* rgw::auth::LocalApplier */
 /* static declaration */
 const std::string rgw::auth::LocalApplier::NO_SUBUSER;
-const std::string rgw::auth::LocalApplier::NO_ACCESS_KEY;
 
 uint32_t rgw::auth::LocalApplier::get_perms_from_aclspec(const DoutPrefixProvider* dpp, const aclspec_t& aclspec) const
 {
@@ -753,12 +742,6 @@ void rgw::auth::LocalApplier::load_acct_info(const DoutPrefixProvider* dpp, RGWU
   user_info = this->user_info;
 }
 
-void rgw::auth::LocalApplier::write_ops_log_entry(rgw_log_entry& entry) const
-{
-  entry.access_key_id = access_key_id;
-  entry.subuser = subuser;
-}
-
 void rgw::auth::RoleApplier::to_str(std::ostream& out) const {
   out << "rgw::auth::LocalApplier(role name =" << role.name;
   for (auto& policy: role.role_policies) {
@@ -860,7 +843,7 @@ rgw::auth::AnonymousEngine::authenticate(const DoutPrefixProvider* dpp, const re
     auto apl = \
       apl_factory->create_apl_local(cct, s, user_info,
                                     rgw::auth::LocalApplier::NO_SUBUSER,
-                                    boost::none, rgw::auth::LocalApplier::NO_ACCESS_KEY);
+                                    boost::none);
     return result_t::grant(std::move(apl));
   }
 }

diff --git a/src/rgw/rgw_auth.h b/src/rgw/rgw_auth.h
index 3fa02bd821fb7c7729aebd16db5169a9c8cbc87a..c65f0b335b10565b358f6800f7fcaefa8bdc58e4 100644 (file)
--- a/src/rgw/rgw_auth.h
+++ b/src/rgw/rgw_auth.h
@@ -17,7 +17,6 @@
 #define RGW_USER_ANON_ID "anonymous"
 
 class RGWCtl;
-struct rgw_log_entry;
 
 namespace rgw {
 namespace auth {
@@ -82,9 +81,6 @@ public:
   virtual string get_subuser() const = 0;
 
   virtual string get_role_tenant() const { return ""; }
-
-  /* write any auth-specific fields that are safe to expose in the ops log */
-  virtual void write_ops_log_entry(rgw_log_entry& entry) const {};
 };
 
 inline std::ostream& operator<<(std::ostream& out,
@@ -498,8 +494,6 @@ public:
     const uint32_t perm_mask;
     const bool is_admin;
     const uint32_t acct_type;
-    const std::string access_key_id;
-    const std::string subuser;
 
   public:
     enum class acct_privilege_t {
@@ -507,23 +501,16 @@ public:
       IS_PLAIN_ACCT
     };
 
-    static const std::string NO_SUBUSER;
-    static const std::string NO_ACCESS_KEY;
-
     AuthInfo(const rgw_user& acct_user,
              const std::string& acct_name,
              const uint32_t perm_mask,
              const acct_privilege_t level,
-             const std::string access_key_id,
-             const std::string subuser,
              const uint32_t acct_type=TYPE_NONE)
     : acct_user(acct_user),
       acct_name(acct_name),
       perm_mask(perm_mask),
       is_admin(acct_privilege_t::IS_ADMIN_ACCT == level),
-      acct_type(acct_type),
-      access_key_id(access_key_id),
-      subuser(subuser) {
+      acct_type(acct_type) {
     }
   };
 
@@ -573,7 +560,6 @@ public:
   uint32_t get_perm_mask() const override { return info.perm_mask; }
   void to_str(std::ostream& out) const override;
   void load_acct_info(const DoutPrefixProvider* dpp, RGWUserInfo& user_info) const override; /* out */
-  void write_ops_log_entry(rgw_log_entry& entry) const override;
   uint32_t get_identity_type() const override { return info.acct_type; }
   string get_acct_name() const override { return info.acct_name; }
   string get_subuser() const override { return {}; }
@@ -602,23 +588,19 @@ protected:
   const RGWUserInfo user_info;
   const std::string subuser;
   uint32_t perm_mask;
-  const std::string access_key_id;
 
   uint32_t get_perm_mask(const std::string& subuser_name,
                          const RGWUserInfo &uinfo) const;
 
 public:
   static const std::string NO_SUBUSER;
-  static const std::string NO_ACCESS_KEY;
 
   LocalApplier(CephContext* const cct,
                const RGWUserInfo& user_info,
                std::string subuser,
-               const boost::optional<uint32_t>& perm_mask,
-               const std::string access_key_id)
+               const boost::optional<uint32_t>& perm_mask)
     : user_info(user_info),
-      subuser(std::move(subuser)),
-      access_key_id(access_key_id) {
+      subuser(std::move(subuser)) {
     if (perm_mask) {
       this->perm_mask = perm_mask.get();
     } else {
@@ -643,7 +625,6 @@ public:
   uint32_t get_identity_type() const override { return TYPE_RGW; }
   string get_acct_name() const override { return {}; }
   string get_subuser() const override { return subuser; }
-  void write_ops_log_entry(rgw_log_entry& entry) const override;
 
   struct Factory {
     virtual ~Factory() {}
@@ -651,8 +632,7 @@ public:
                                       const req_state* s,
                                       const RGWUserInfo& user_info,
                                       const std::string& subuser,
-                                      const boost::optional<uint32_t>& perm_mask,
-                                      const std::string& access_key_id) const = 0;
+                                      const boost::optional<uint32_t>& perm_mask) const = 0;
     };
 };
 

diff --git a/src/rgw/rgw_auth_filters.h b/src/rgw/rgw_auth_filters.h
index 1b59f3bb25a1bed099bc862a664add518429b11b..bea9665e4167d910868cf7859fd592780e69712e 100644 (file)
--- a/src/rgw/rgw_auth_filters.h
+++ b/src/rgw/rgw_auth_filters.h
@@ -118,10 +118,6 @@ public:
   void modify_request_state(const DoutPrefixProvider* dpp, req_state * s) const override {     /* in/out */
     return get_decoratee().modify_request_state(dpp, s);
   }
-
-  void write_ops_log_entry(rgw_log_entry& entry) const override {
-    return get_decoratee().write_ops_log_entry(entry);
-  }
 };
 
 

diff --git a/src/rgw/rgw_auth_keystone.cc b/src/rgw/rgw_auth_keystone.cc
index 0d45af085b5cb3146cb7d335cb62cbe64beaff5f..124b50793e4da3b7e63d1f9a8487c0155b5cbe67 100644 (file)
--- a/src/rgw/rgw_auth_keystone.cc
+++ b/src/rgw/rgw_auth_keystone.cc
@@ -133,10 +133,8 @@ TokenEngine::get_creds_info(const TokenEngine::token_envelope_t& token,
      * the access rights through the perm_mask. At least at this layer. */
     RGW_PERM_FULL_CONTROL,
     level,
-    rgw::auth::RemoteApplier::AuthInfo::NO_ACCESS_KEY,
-    rgw::auth::RemoteApplier::AuthInfo::NO_SUBUSER,
-    TYPE_KEYSTONE
-};
+    TYPE_KEYSTONE,
+  };
 }
 
 static inline const std::string
@@ -499,8 +497,7 @@ EC2Engine::get_acl_strategy(const EC2Engine::token_envelope_t&) const
 
 EC2Engine::auth_info_t
 EC2Engine::get_creds_info(const EC2Engine::token_envelope_t& token,
-                          const std::vector<std::string>& admin_roles,
-                          const std::string& access_key_id
+                          const std::vector<std::string>& admin_roles
                          ) const noexcept
 {
   using acct_privilege_t = \
@@ -524,9 +521,7 @@ EC2Engine::get_creds_info(const EC2Engine::token_envelope_t& token,
      * the access rights through the perm_mask. At least at this layer. */
     RGW_PERM_FULL_CONTROL,
     level,
-    access_key_id,
-    rgw::auth::RemoteApplier::AuthInfo::NO_SUBUSER,
-    TYPE_KEYSTONE
+    TYPE_KEYSTONE,
   };
 }
 
@@ -594,7 +589,7 @@ rgw::auth::Engine::result_t EC2Engine::authenticate(
                   << " expires: " << t->get_expires() << dendl;
 
     auto apl = apl_factory->create_apl_remote(cct, s, get_acl_strategy(*t),
-                                              get_creds_info(*t, accepted_roles.admin, std::string(access_key_id)));
+                                              get_creds_info(*t, accepted_roles.admin));
     return result_t::grant(std::move(apl), completer_factory(boost::none));
   }
 }

diff --git a/src/rgw/rgw_auth_keystone.h b/src/rgw/rgw_auth_keystone.h
index c9addb0098ace69e116fb12667fbf72c2264b593..4ad20442b96beb729e25c199461ef9821d2d2a55 100644 (file)
--- a/src/rgw/rgw_auth_keystone.h
+++ b/src/rgw/rgw_auth_keystone.h
@@ -138,8 +138,7 @@ class EC2Engine : public rgw::auth::s3::AWSEngine {
   /* Helper methods. */
   acl_strategy_t get_acl_strategy(const token_envelope_t& token) const;
   auth_info_t get_creds_info(const token_envelope_t& token,
-                             const std::vector<std::string>& admin_roles,
-                             const std::string& access_key_id
+                             const std::vector<std::string>& admin_roles
                             ) const noexcept;
   std::pair<boost::optional<token_envelope_t>, int>
   get_from_keystone(const DoutPrefixProvider* dpp,

diff --git a/src/rgw/rgw_auth_s3.h b/src/rgw/rgw_auth_s3.h
index cc1dbf90b0e5e4719ff7fd342db541722bae2812..4288bd2f0d4e040789f0fe28a660ce2e62b7e611 100644 (file)
--- a/src/rgw/rgw_auth_s3.h
+++ b/src/rgw/rgw_auth_s3.h
@@ -56,10 +56,9 @@ class STSAuthStrategy : public rgw::auth::Strategy,
                             const req_state* const s,
                             const RGWUserInfo& user_info,
                             const std::string& subuser,
-                            const boost::optional<uint32_t>& perm_mask,
-                            const std::string& access_key_id) const override {
+                            const boost::optional<uint32_t>& perm_mask) const override {
     auto apl = rgw::auth::add_sysreq(cct, ctl, s,
-      rgw::auth::LocalApplier(cct, user_info, subuser, perm_mask, access_key_id));
+      rgw::auth::LocalApplier(cct, user_info, subuser, perm_mask));
     return aplptr_t(new decltype(apl)(std::move(apl)));
   }
 
@@ -179,10 +178,9 @@ class AWSAuthStrategy : public rgw::auth::Strategy,
                             const req_state* const s,
                             const RGWUserInfo& user_info,
                             const std::string& subuser,
-                            const boost::optional<uint32_t>& perm_mask,
-                            const std::string& access_key_id) const override {
+                            const boost::optional<uint32_t>& perm_mask) const override {
     auto apl = rgw::auth::add_sysreq(cct, ctl, s,
-      rgw::auth::LocalApplier(cct, user_info, subuser, perm_mask, access_key_id));
+      rgw::auth::LocalApplier(cct, user_info, subuser, perm_mask));
     /* TODO(rzarzynski): replace with static_ptr. */
     return aplptr_t(new decltype(apl)(std::move(apl)));
   }

diff --git a/src/rgw/rgw_log.cc b/src/rgw/rgw_log.cc
index c10f63c08b97c783f8a4f83abaf438dcd543bc26..b22f437be554b0b9f12f961076e2a89573ad1713 100644 (file)
--- a/src/rgw/rgw_log.cc
+++ b/src/rgw/rgw_log.cc
@@ -314,13 +314,7 @@ void rgw_format_ops_log_entry(struct rgw_log_entry& entry, Formatter *formatter)
       formatter->close_section();
     }
   }
-  if (!entry.access_key_id.empty()) {
-    formatter->dump_string("access_key_id", entry.access_key_id);
-  }
-  if (!entry.subuser.empty()) {
-    formatter->dump_string("subuser", entry.subuser);
-  }
-  formatter->dump_bool("temp_url", entry.temp_url);
+
   formatter->close_section();
 }
 
@@ -606,7 +600,6 @@ int rgw_log_op(RGWREST* const rest, struct req_state *s, const string& op_name,
 
   if (s->auth.identity) {
     entry.identity_type = s->auth.identity->get_identity_type();
-    s->auth.identity->write_ops_log_entry(entry);
   } else {
     entry.identity_type = TYPE_NONE;
   }

diff --git a/src/rgw/rgw_log.h b/src/rgw/rgw_log.h
index d91e27c2d0bf4b191a7f0713459dbaa37a9dc5d6..7b384c2d854ce713a9f05bf9687a5795d143b1e0 100644 (file)
--- a/src/rgw/rgw_log.h
+++ b/src/rgw/rgw_log.h
@@ -41,12 +41,9 @@ struct rgw_log_entry {
   string trans_id;
   std::vector<string> token_claims;
   uint32_t identity_type;
-  std::string access_key_id;
-  std::string subuser;
-  bool temp_url {false};
 
   void encode(bufferlist &bl) const {
-    ENCODE_START(13, 5, bl);
+    ENCODE_START(12, 5, bl);
     encode(object_owner.id, bl);
     encode(bucket_owner.id, bl);
     encode(bucket, bl);
@@ -72,13 +69,10 @@ struct rgw_log_entry {
     encode(trans_id, bl);
     encode(token_claims, bl);
     encode(identity_type,bl);
-    encode(access_key_id, bl);
-    encode(subuser, bl);
-    encode(temp_url, bl);
     ENCODE_FINISH(bl);
   }
   void decode(bufferlist::const_iterator &p) {
-    DECODE_START_LEGACY_COMPAT_LEN(13, 5, 5, p);
+    DECODE_START_LEGACY_COMPAT_LEN(12, 5, 5, p);
     decode(object_owner.id, p);
     if (struct_v > 3)
       decode(bucket_owner.id, p);
@@ -133,11 +127,6 @@ struct rgw_log_entry {
     if (struct_v >= 12) {
       decode(identity_type, p);
     }
-    if (struct_v >= 13) {
-      decode(access_key_id, p);
-      decode(subuser, p);
-      decode(temp_url, p);
-    }
     DECODE_FINISH(p);
   }
   void dump(ceph::Formatter *f) const;

diff --git a/src/rgw/rgw_rest_s3.cc b/src/rgw/rgw_rest_s3.cc
index a2ea5f8dc27eac33237248761b5e6496e2801dc4..724c3d30d84b79842583fe47c273013757b52afc 100644 (file)
--- a/src/rgw/rgw_rest_s3.cc
+++ b/src/rgw/rgw_rest_s3.cc
@@ -5667,8 +5667,6 @@ rgw::auth::s3::LDAPEngine::get_creds_info(const rgw::RGWToken& token) const noex
     token.id,
     RGW_PERM_FULL_CONTROL,
     acct_privilege_t::IS_PLAIN_ACCT,
-    rgw::auth::RemoteApplier::AuthInfo::NO_ACCESS_KEY,
-    rgw::auth::RemoteApplier::AuthInfo::NO_SUBUSER,
     TYPE_LDAP
   };
 }
@@ -5778,7 +5776,7 @@ rgw::auth::s3::LocalEngine::authenticate(
     return result_t::deny(-ERR_SIGNATURE_NO_MATCH);
   }
 
-  auto apl = apl_factory->create_apl_local(cct, s, user_info, k.subuser, boost::none, access_key_id);
+  auto apl = apl_factory->create_apl_local(cct, s, user_info, k.subuser, boost::none);
   return result_t::grant(std::move(apl), completer_factory(k.key));
 }
 
@@ -5793,8 +5791,6 @@ rgw::auth::s3::STSEngine::get_creds_info(const STS::SessionToken& token) const n
     token.acct_name,
     token.perm_mask,
     (token.is_admin) ? acct_privilege_t::IS_ADMIN_ACCT: acct_privilege_t::IS_PLAIN_ACCT,
-    token.access_key_id,
-    rgw::auth::RemoteApplier::AuthInfo::NO_SUBUSER,
     token.acct_type
   };
 }
@@ -5954,7 +5950,7 @@ rgw::auth::s3::STSEngine::authenticate(
     return result_t::grant(std::move(apl), completer_factory(token.secret_access_key));
   } else { // This is for all local users of type TYPE_RGW or TYPE_NONE
     string subuser;
-    auto apl = local_apl_factory->create_apl_local(cct, s, user_info, subuser, token.perm_mask, std::string(_access_key_id));
+    auto apl = local_apl_factory->create_apl_local(cct, s, user_info, subuser, token.perm_mask);
     return result_t::grant(std::move(apl), completer_factory(token.secret_access_key));
   }
 }

diff --git a/src/rgw/rgw_swift_auth.cc b/src/rgw/rgw_swift_auth.cc
index 4c85d82baebcb00f4f9c1cec2e10a0851d3c8246..da0a370b71ab7b6f231ff4654e49710c4be80889 100644 (file)
--- a/src/rgw/rgw_swift_auth.cc
+++ b/src/rgw/rgw_swift_auth.cc
@@ -60,12 +60,6 @@ void TempURLApplier::modify_request_state(const DoutPrefixProvider* dpp, req_sta
 
 }
 
-void TempURLApplier::write_ops_log_entry(rgw_log_entry& entry) const
-{
-  LocalApplier::write_ops_log_entry(entry);
-  entry.temp_url = true;
-}
-
 /* TempURL: engine */
 bool TempURLEngine::is_applicable(const req_state* const s) const noexcept
 {
@@ -463,8 +457,7 @@ ExternalTokenEngine::authenticate(const DoutPrefixProvider* dpp,
 
   auto apl = apl_factory->create_apl_local(cct, s, tmp_uinfo,
                                            extract_swift_subuser(swift_user),
-                                           boost::none,
-                                           rgw::auth::LocalApplier::NO_ACCESS_KEY);
+                                           boost::none);
   return result_t::grant(std::move(apl));
 }
 
@@ -618,7 +611,7 @@ SignedTokenEngine::authenticate(const DoutPrefixProvider* dpp,
 
   auto apl = apl_factory->create_apl_local(cct, s, user_info,
                                            extract_swift_subuser(swift_user),
-                                           boost::none, rgw::auth::LocalApplier::NO_ACCESS_KEY);
+                                           boost::none);
   return result_t::grant(std::move(apl));
 }
 

diff --git a/src/rgw/rgw_swift_auth.h b/src/rgw/rgw_swift_auth.h
index 2aa89caf599c4c2ec0eaa53d43def557efc74062..ba319405bfd47f385b46934308db1934d74dd455 100644 (file)
--- a/src/rgw/rgw_swift_auth.h
+++ b/src/rgw/rgw_swift_auth.h
@@ -24,11 +24,10 @@ class TempURLApplier : public rgw::auth::LocalApplier {
 public:
   TempURLApplier(CephContext* const cct,
                  const RGWUserInfo& user_info)
-    : LocalApplier(cct, user_info, LocalApplier::NO_SUBUSER, boost::none, LocalApplier::NO_ACCESS_KEY) {
+    : LocalApplier(cct, user_info, LocalApplier::NO_SUBUSER, boost::none) {
   };
 
   void modify_request_state(const DoutPrefixProvider* dpp, req_state * s) const override; /* in/out */
-  void write_ops_log_entry(rgw_log_entry& entry) const override;
 
   struct Factory {
     virtual ~Factory() {}
@@ -154,7 +153,7 @@ class SwiftAnonymousApplier : public rgw::auth::LocalApplier {
   public:
     SwiftAnonymousApplier(CephContext* const cct,
                           const RGWUserInfo& user_info)
-      : LocalApplier(cct, user_info, LocalApplier::NO_SUBUSER, boost::none, LocalApplier::NO_ACCESS_KEY) {
+      : LocalApplier(cct, user_info, LocalApplier::NO_SUBUSER, boost::none) {
       };
     bool is_admin_of(const rgw_user& uid) const {return false;}
     bool is_owner_of(const rgw_user& uid) const {return uid.id.compare(RGW_USER_ANON_ID) == 0;}
@@ -226,12 +225,11 @@ class DefaultStrategy : public rgw::auth::Strategy,
                             const req_state* const s,
                             const RGWUserInfo& user_info,
                             const std::string& subuser,
-                            const boost::optional<uint32_t>& perm_mask,
-                            const std::string& access_key_id) const override {
+                            const boost::optional<uint32_t>& perm_mask) const override {
     auto apl = \
       rgw::auth::add_3rdparty(ctl, rgw_user(s->account_name),
         rgw::auth::add_sysreq(cct, ctl, s,
-          rgw::auth::LocalApplier(cct, user_info, subuser, perm_mask, access_key_id)));
+          rgw::auth::LocalApplier(cct, user_info, subuser, perm_mask)));
     /* TODO(rzarzynski): replace with static_ptr. */
     return aplptr_t(new decltype(apl)(std::move(apl)));
   }