rgw/sts: adding role name and role session to ops log.

Also adding authentication type for all ops.

Fixes: https://tracker.ceph.com/issues/51152
Signed-off-by: Pritha Srivastava <prsrivas@redhat.com>
(cherry picked from commit ea61dd2c54377ba4a58a6c08ce9156068d36993b)

Conflicts:
	src/test/rgw/test_rgw_lua.cc

Cherry-pick notes:
- Conflicts due to rename of sal::RGWUser to sal::User after Pacific

diff --git a/src/rgw/rgw_auth.cc b/src/rgw/rgw_auth.cc
index ce613f40d1be021b52607f0ee46de8f5d96c9c18..42fe1133fc9878db5df20d20bf236ce9eefe4089 100644 (file)
--- a/src/rgw/rgw_auth.cc
+++ b/src/rgw/rgw_auth.cc
@@ -824,6 +824,8 @@ void rgw::auth::RoleApplier::modify_request_state(const DoutPrefixProvider *dpp,
   s->env.emplace("aws:TokenIssueTime", token_issued_at);
 
   s->token_claims.emplace_back("sts");
+  s->token_claims.emplace_back("role_name:" + role.tenant + "$" + role.name);
+  s->token_claims.emplace_back("role_session:" + role_session_name);
   for (auto& it : token_claims) {
     s->token_claims.emplace_back(it);
   }

diff --git a/src/rgw/rgw_log.cc b/src/rgw/rgw_log.cc
index efe165089ff6ba435ca883b96ed76f345ee84316..02d612bbf195f1c8881668b6ae81ab5e658c8d09 100644 (file)
--- a/src/rgw/rgw_log.cc
+++ b/src/rgw/rgw_log.cc
@@ -282,9 +282,28 @@ void rgw_format_ops_log_entry(struct rgw_log_entry& entry, Formatter *formatter)
     formatter->close_section();
   }
   formatter->dump_string("trans_id", entry.trans_id);
+  switch(entry.identity_type) {
+    case TYPE_RGW:
+      formatter->dump_string("authentication_type","Local");
+      break;
+    case TYPE_LDAP:
+      formatter->dump_string("authentication_type","LDAP");
+      break;
+    case TYPE_KEYSTONE:
+      formatter->dump_string("authentication_type","Keystone");
+      break;
+    case TYPE_WEB:
+      formatter->dump_string("authentication_type","OIDC Provider");
+      break;
+    case TYPE_ROLE:
+      formatter->dump_string("authentication_type","STS");
+      break;
+    default:
+      break;
+  }
   if (entry.token_claims.size() > 0) {
     if (entry.token_claims[0] == "sts") {
-      formatter->open_object_section("sts_token_claims");
+      formatter->open_object_section("sts_info");
       for (const auto& iter: entry.token_claims) {
         auto pos = iter.find(":");
         if (pos != string::npos) {
@@ -566,6 +585,8 @@ int rgw_log_op(RGWREST* const rest, struct req_state *s, const string& op_name,
 
   entry.op = op_name;
 
+  entry.identity_type = s->auth.identity->get_identity_type();
+
   if (! s->token_claims.empty()) {
     entry.token_claims = std::move(s->token_claims);
   }

diff --git a/src/rgw/rgw_log.h b/src/rgw/rgw_log.h
index 90131889da4e6e95b775267188ba5d8a90838fa6..5f5951f9e2434088dcbd010fcd16fa9f8f16bf10 100644 (file)
--- a/src/rgw/rgw_log.h
+++ b/src/rgw/rgw_log.h
@@ -40,9 +40,10 @@ struct rgw_log_entry {
   headers_map x_headers;
   string trans_id;
   std::vector<string> token_claims;
+  uint32_t identity_type;
 
   void encode(bufferlist &bl) const {
-    ENCODE_START(11, 5, bl);
+    ENCODE_START(12, 5, bl);
     encode(object_owner.id, bl);
     encode(bucket_owner.id, bl);
     encode(bucket, bl);
@@ -67,10 +68,11 @@ struct rgw_log_entry {
     encode(x_headers, bl);
     encode(trans_id, bl);
     encode(token_claims, bl);
+    encode(identity_type,bl);
     ENCODE_FINISH(bl);
   }
   void decode(bufferlist::const_iterator &p) {
-    DECODE_START_LEGACY_COMPAT_LEN(11, 5, 5, p);
+    DECODE_START_LEGACY_COMPAT_LEN(12, 5, 5, p);
     decode(object_owner.id, p);
     if (struct_v > 3)
       decode(bucket_owner.id, p);
@@ -122,6 +124,9 @@ struct rgw_log_entry {
     if (struct_v >= 11) {
       decode(token_claims, p);
     }
+    if (struct_v >= 12) {
+      decode(identity_type, p);
+    }
     DECODE_FINISH(p);
   }
   void dump(ceph::Formatter *f) const;

diff --git a/src/test/rgw/test_rgw_lua.cc b/src/test/rgw/test_rgw_lua.cc
index 7d7af6d786f3de2b1c54d92e2049cfa3acb7d5e0..db1eab8cf468a9197f59bbbc309b406cd231cf40 100644 (file)
--- a/src/test/rgw/test_rgw_lua.cc
+++ b/src/test/rgw/test_rgw_lua.cc
@@ -1,11 +1,15 @@
 #include <gtest/gtest.h>
 #include "common/ceph_context.h"
 #include "rgw/rgw_common.h"
+#include "rgw/rgw_auth.h"
 #include "rgw/rgw_process.h"
 #include "rgw/rgw_sal_rados.h"
 #include "rgw/rgw_lua_request.h"
 
 using namespace rgw;
+using boost::container::flat_set;
+using rgw::auth::Identity;
+using rgw::auth::Principal;
 
 class CctCleaner {
   CephContext* cct;
@@ -20,6 +24,47 @@ public:
   }
 };
 
+class FakeIdentity : public Identity {
+public:
+  FakeIdentity() = default;
+
+  uint32_t get_perms_from_aclspec(const DoutPrefixProvider* dpp, const aclspec_t& aclspec) const override {
+    return 0;
+  };
+
+  bool is_admin_of(const rgw_user& uid) const override {
+    return false;
+  }
+
+  bool is_owner_of(const rgw_user& uid) const override {
+    return false;
+  }
+
+  virtual uint32_t get_perm_mask() const override {
+    return 0;
+  }
+
+  uint32_t get_identity_type() const override {
+    return TYPE_RGW;
+  }
+
+  string get_acct_name() const override {
+    return "";
+  }
+
+  string get_subuser() const override {
+    return "";
+  }
+
+  void to_str(std::ostream& out) const override {
+    return;
+  }
+
+  bool is_identity(const flat_set<Principal>& ids) const override {
+    return false;
+  }
+};
+
 class TestRGWUser : public sal::RGWUser {
 public:
   virtual int list_buckets(const DoutPrefixProvider *dpp, const string&, const string&, uint64_t, bool, sal::RGWBucketList&, optional_yield y) override {
@@ -563,6 +608,9 @@ TEST(TestRGWLua, OpsLog)
   s.cio = &ac; 
        s.cct->_conf->rgw_ops_log_rados = false;
 
+  s.auth.identity = std::unique_ptr<rgw::auth::Identity>(
+                        new FakeIdentity());
+
   auto rc = lua::request::execute(store.get(), nullptr, olog.get(), &s, "put_obj", script);
   EXPECT_EQ(rc, 0);