rgw/iam: add RemoveClientIDFromOpenIDConnectProvider

Signed-off-by: Raja Sharma <raja@ibm.com>
Fixes : https://tracker.ceph.com/issues/70015

diff --git a/doc/radosgw/oidc.rst b/doc/radosgw/oidc.rst
index 147789930971c28e21bd27a5301314e88aa0cd17..de3725a9b3701c5fb5e12daf516873b315a6eaca 100644 (file)
--- a/doc/radosgw/oidc.rst
+++ b/doc/radosgw/oidc.rst
@@ -119,6 +119,29 @@ Example::
     &OpenIDConnectProviderArn=arn:aws:iam:::oidc-provider/localhost:8080/auth/realms/quickstart
     &ClientID=app-jee-jsp"
 
+RemoveClientIDFromOpenIDConnectProvider
+----------------------------------
+
+Remove a client id from the list of existing client ids registered while creating an OpenIDConnectProvider.
+
+Request Parameters
+~~~~~~~~~~~~~~~~~~
+
+``OpenIDConnectProviderArn``
+
+:Description: ARN of the IDP which is returned by the Create API.
+:Type: String
+
+``ClientID``
+
+:Description: Client ID to remove from the existing OpenIDConnectProvider.
+:Type: String
+
+Example::
+  POST "<hostname>?Action=Action=RemoveClientIDFromOpenIDConnectProvider
+    &OpenIDConnectProviderArn=arn:aws:iam:::oidc-provider/localhost:8080/auth/realms/quickstart
+    &ClientID=app-jee-jsp"
+
 UpdateOpenIDConnectProviderThumbprint
 -------------------------------------
 
@@ -141,4 +164,4 @@ Request Parameters
 Example::
   POST "<hostname>?Action=Action=UpdateOpenIDConnectProviderThumbprint
     &OpenIDConnectProviderArn=arn:aws:iam:::oidc-provider/localhost:8080/auth/realms/quickstart
-    &&ThumbprintList.list.1=ABCDB3515DD0D319DD219A43A9EA727AD6061234"
\ No newline at end of file
+    &&ThumbprintList.list.1=ABCDB3515DD0D319DD219A43A9EA727AD6061234"

diff --git a/src/rgw/rgw_auth_s3.cc b/src/rgw/rgw_auth_s3.cc
index 17bbe2b8a3c3782d25a1c460e6d4d2ec2b8e95d2..a60aebd480720315f3f97df94530af7d6ace6879 100644 (file)
--- a/src/rgw/rgw_auth_s3.cc
+++ b/src/rgw/rgw_auth_s3.cc
@@ -499,6 +499,7 @@ bool is_non_s3_op(RGWOpType op_type)
   case RGW_OP_GET_OIDC_PROVIDER:
   case RGW_OP_LIST_OIDC_PROVIDERS:
   case RGW_OP_ADD_CLIENTID_TO_OIDC_PROVIDER:
+  case RGW_OP_REMOVE_CLIENTID_FROM_OIDC_PROVIDER:
   case RGW_OP_UPDATE_OIDC_PROVIDER_THUMBPRINT:
   case RGW_OP_PUBSUB_TOPIC_CREATE:
   case RGW_OP_PUBSUB_TOPICS_LIST:

diff --git a/src/rgw/rgw_iam_policy.cc b/src/rgw/rgw_iam_policy.cc
index ef6761d42227f74e29ee160ffd676c08f6bd08f8..db7d634e48533c291fd4df9adc42525f9b9f55d6 100644 (file)
--- a/src/rgw/rgw_iam_policy.cc
+++ b/src/rgw/rgw_iam_policy.cc
@@ -164,6 +164,7 @@ static const actpair actpairs[] =
  { "iam:GetOIDCProvider", iamGetOIDCProvider},
  { "iam:ListOIDCProviders", iamListOIDCProviders},
  { "iam:AddClientIdToOIDCProvider", iamAddClientIdToOIDCProvider},
+ { "iam:RemoveCientIdFromOIDCProvider", iamRemoveClientIdFromOIDCProvider},
  { "iam:UpdateOIDCProviderThumbprint", iamUpdateOIDCProviderThumbprint},
  { "iam:TagRole", iamTagRole},
  { "iam:ListRoleTags", iamListRoleTags},
@@ -1569,6 +1570,9 @@ const char* action_bit_string(uint64_t action) {
   case iamAddClientIdToOIDCProvider:
     return "iam:AddClientIdToOIDCProvider";
 
+  case iamRemoveClientIdFromOIDCProvider:
+    return "iam:RemoveClientIdFromOIDCProvider";
+
   case iamUpdateOIDCProviderThumbprint:
     return "iam:UpdateOIDCProviderThumbprint";
 

diff --git a/src/rgw/rgw_iam_policy.h b/src/rgw/rgw_iam_policy.h
index dd323ee4b9c87a1f5b8ca808cf1b04e911956cf8..fbee04e2acf4fc4aa2c278fd3f8c1c77d0374697 100644 (file)
--- a/src/rgw/rgw_iam_policy.h
+++ b/src/rgw/rgw_iam_policy.h
@@ -147,6 +147,7 @@ enum {
   iamGetOIDCProvider,
   iamListOIDCProviders,
   iamAddClientIdToOIDCProvider,
+  iamRemoveClientIdFromOIDCProvider,
   iamUpdateOIDCProviderThumbprint,
   iamTagRole,
   iamListRoleTags,

diff --git a/src/rgw/rgw_op_type.h b/src/rgw/rgw_op_type.h
index 2c8225d289e0952e09d28ae77b9e18b7ffa39367..01f5a432e92e4905ad2834c013966ac75b85eb01 100644 (file)
--- a/src/rgw/rgw_op_type.h
+++ b/src/rgw/rgw_op_type.h
@@ -166,6 +166,7 @@ enum RGWOpType {
   RGW_OP_GET_OIDC_PROVIDER,
   RGW_OP_LIST_OIDC_PROVIDERS,
   RGW_OP_ADD_CLIENTID_TO_OIDC_PROVIDER,
+  RGW_OP_REMOVE_CLIENTID_FROM_OIDC_PROVIDER,
   RGW_OP_UPDATE_OIDC_PROVIDER_THUMBPRINT,
 };
 

diff --git a/src/rgw/rgw_rest_iam.cc b/src/rgw/rgw_rest_iam.cc
index adf79e978af5f7d4caab4ee429a9dabe1d8a5fd6..04a45203f47cfcd33de456b0269663a7bd1faee3 100644 (file)
--- a/src/rgw/rgw_rest_iam.cc
+++ b/src/rgw/rgw_rest_iam.cc
@@ -46,6 +46,7 @@ static const std::unordered_map<std::string_view, op_generator> op_generators =
   {"GetOpenIDConnectProvider", [](const bufferlist& bl_post_body) -> RGWOp* {return new RGWGetOIDCProvider;}},
   {"DeleteOpenIDConnectProvider", [](const bufferlist& bl_post_body) -> RGWOp* {return new RGWDeleteOIDCProvider;}},
   {"AddClientIDToOpenIDConnectProvider", [](const bufferlist& bl_post_body) -> RGWOp* {return new RGWAddClientIdToOIDCProvider;}},
+  {"RemoveClientIDFromOpenIDConnectProvider", [](const bufferlist& bl_post_body) -> RGWOp* {return new RGWRemoveCientIdFromOIDCProvider;}},
   {"UpdateOpenIDConnectProviderThumbprint", [](const bufferlist& bl_post_body) -> RGWOp* {return new RGWUpdateOIDCProviderThumbprint;}},
   {"TagRole", [](const bufferlist& bl_post_body) -> RGWOp* {return new RGWTagRole(bl_post_body);}},
   {"ListRoleTags", [](const bufferlist& bl_post_body) -> RGWOp* {return new RGWListRoleTags;}},

diff --git a/src/rgw/rgw_rest_oidc_provider.cc b/src/rgw/rgw_rest_oidc_provider.cc
index 37b5e7edc2631c33ab21decda781c9f650aea8e3..20547e0eb230f5fcc1b888dbd8b541810bdf18e5 100644 (file)
--- a/src/rgw/rgw_rest_oidc_provider.cc
+++ b/src/rgw/rgw_rest_oidc_provider.cc
@@ -406,6 +406,77 @@ void RGWAddClientIdToOIDCProvider::execute(optional_yield y)
   }
 }
 
+RGWRemoveCientIdFromOIDCProvider::RGWRemoveCientIdFromOIDCProvider()
+    : RGWRestOIDCProvider(rgw::IAM::iamRemoveClientIdFromOIDCProvider, RGW_CAP_WRITE)
+{
+}
+
+int RGWRemoveCientIdFromOIDCProvider::init_processing(optional_yield y)
+{
+  std::string_view account;
+  if (const auto& acc = s->auth.identity->get_account(); acc) {
+    account = acc->id;
+  } else {
+    account = s->user->get_tenant();
+  }
+  std::string provider_arn = s->info.args.get("OpenIDConnectProviderArn");
+  auto ret = validate_provider_arn(provider_arn, account,
+                               resource, url, s->err.message);
+  if (ret < 0) {
+    return ret;
+  }
+
+  client_id = s->info.args.get("ClientID");
+
+  if (client_id.empty()) {
+    s->err.message = "Missing required element ClientID";
+    ldpp_dout(this, 20) << "ERROR: ClientID is empty" << dendl;
+    return -EINVAL;
+  }
+
+  if (client_id.size() > MAX_OIDC_CLIENT_ID_LEN) {
+    s->err.message = "ClientID cannot exceed the maximum length of "
+        + std::to_string(MAX_OIDC_CLIENT_ID_LEN);
+    ldpp_dout(this, 20) << "ERROR: ClientID length exceeded " << MAX_OIDC_CLIENT_ID_LEN << dendl;
+    return -EINVAL;
+  }
+
+  return 0;
+}
+
+void RGWRemoveCientIdFromOIDCProvider::execute(optional_yield y)
+{
+  RGWOIDCProviderInfo info;
+  op_ret = driver->load_oidc_provider(this, y, resource.account, url, info);
+
+  if (op_ret < 0) {
+    if (op_ret != -ENOENT && op_ret != -EINVAL) {
+      op_ret = ERR_INTERNAL_ERROR;
+    }
+    return;
+  }
+
+  auto position = std::find(info.client_ids.begin(), info.client_ids.end(), client_id);
+
+  if(position != info.client_ids.end()) {
+    info.client_ids.erase(position);
+    constexpr bool exclusive = false;
+    op_ret = driver->store_oidc_provider(this, y, info, exclusive);
+  }
+
+  if (op_ret == 0) {
+    op_ret = 0;
+    s->formatter->open_object_section("RemoveClientIDFromOpenIDConnectProviderResponse");
+    s->formatter->open_object_section("ResponseMetadata");
+    s->formatter->dump_string("RequestId", s->trans_id);
+    s->formatter->close_section();
+    s->formatter->open_object_section("RemoveClientIDFromOpenIDConnectProviderResponse");
+    dump_oidc_provider(info, s->formatter);
+    s->formatter->close_section();
+    s->formatter->close_section();
+  }
+}
+
 RGWUpdateOIDCProviderThumbprint::RGWUpdateOIDCProviderThumbprint()
   : RGWRestOIDCProvider(rgw::IAM::iamUpdateOIDCProviderThumbprint, RGW_CAP_WRITE)
 {

diff --git a/src/rgw/rgw_rest_oidc_provider.h b/src/rgw/rgw_rest_oidc_provider.h
index e64243a4e727e5ad4a29e2bfd462eb22eec716c0..4ed3208d56f601a5e3d686cc5df308355814dc4e 100644 (file)
--- a/src/rgw/rgw_rest_oidc_provider.h
+++ b/src/rgw/rgw_rest_oidc_provider.h
@@ -75,6 +75,18 @@ public:
   RGWOpType get_type() override { return RGW_OP_ADD_CLIENTID_TO_OIDC_PROVIDER; }
 };
 
+class RGWRemoveCientIdFromOIDCProvider : public RGWRestOIDCProvider {
+  std::string url;
+  std::string client_id;
+public:
+  RGWRemoveCientIdFromOIDCProvider();
+
+  int init_processing(optional_yield y);
+  void execute(optional_yield y) override;
+  const char* name() const override { return "remove_client_id_from_oidc_provider"; }
+  RGWOpType get_type() override { return RGW_OP_REMOVE_CLIENTID_FROM_OIDC_PROVIDER; }
+};
+
 class RGWUpdateOIDCProviderThumbprint : public RGWRestOIDCProvider {
   std::string url;
   std::vector<std::string> thumbprints;