rgw/account: Support backward compatibility for s3:PutAcls calls for users migrated...

fixes tracker https://tracker.ceph.com/issues/73759

Signed-off-by: kchheda3 <kchheda3@bloomberg.net>

diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc
index 34836da3f7eafbc604c7f1289c56e42f622136e2..dc9c624cfa072d75e9c9acc3852082015e20c19a 100644 (file)
--- a/src/rgw/rgw_op.cc
+++ b/src/rgw/rgw_op.cc
@@ -6691,8 +6691,12 @@ void RGWPutACLs::execute(optional_yield y)
   if (op_ret < 0)
     return;
 
+  // only allow acl owner to change if the requester views them as equivalent.
+  // the requester may change between their user id and account id.
   if (!existing_owner.empty() &&
-      existing_owner.id != new_policy.get_owner().id) {
+      existing_owner.id != new_policy.get_owner().id &&
+      !(s->auth.identity->is_owner_of(existing_owner.id) &&
+        s->auth.identity->is_owner_of(new_policy.get_owner().id))) {
     s->err.message = "Cannot modify ACL Owner";
     op_ret = -EPERM;
     return;