mgr/dashboard: Enhance check if configured RGW admin ID has a set system flag

Fixes https://tracker.ceph.com/issues/24574

Signed-off-by: Volker Theile <vtheile@suse.com>

diff --git a/src/pybind/mgr/dashboard/controllers/rgw.py b/src/pybind/mgr/dashboard/controllers/rgw.py
index e1b551aafe64e3a8e171ed92ecbd289c498d3d36..a720f75a73c8855aed9f82cedf83a6f8e13d0e5e 100644 (file)
--- a/src/pybind/mgr/dashboard/controllers/rgw.py
+++ b/src/pybind/mgr/dashboard/controllers/rgw.py
@@ -26,10 +26,15 @@ class Rgw(BaseController):
                 status['message'] = 'Failed to connect to the Object Gateway\'s Admin Ops API.'
                 raise RequestException(status['message'])
             # Ensure the API user ID is known by the RGW.
-            if not instance.is_system_user():
+            if not instance.user_exists():
                 status['message'] = 'The user "{}" is unknown to the Object Gateway.'.format(
                     instance.userid)
                 raise RequestException(status['message'])
+            # Ensure the system flag is set for the API user ID.
+            if not instance.is_system_user():
+                status['message'] = 'The system flag is not set for user "{}".'.format(
+                    instance.userid)
+                raise RequestException(status['message'])
             status['available'] = True
         except RequestException:
             pass

diff --git a/src/pybind/mgr/dashboard/services/rgw_client.py b/src/pybind/mgr/dashboard/services/rgw_client.py
index aa2bbf3e8ace196af96437b8ed1c6f76cb5fd0c8..2ba80dc8d32f1aa336bfe6aba11d81c0d325df01 100644 (file)
--- a/src/pybind/mgr/dashboard/services/rgw_client.py
+++ b/src/pybind/mgr/dashboard/services/rgw_client.py
@@ -2,6 +2,7 @@
 from __future__ import absolute_import
 
 import re
+from distutils.util import strtobool
 from ..awsauth import S3Auth
 from ..settings import Settings, Options
 from ..rest_client import RestClient, RequestException
@@ -206,13 +207,23 @@ class RgwClient(RestClient):
         return response['data']['user_id']
 
     @RestClient.api_get('/{admin_path}/metadata/user', resp_structure='[+]')
-    def _is_system_user(self, admin_path, request=None):
+    def _user_exists(self, admin_path, request=None):
         # pylint: disable=unused-argument
         response = request()
         return self.userid in response
 
+    def user_exists(self):
+        return self._user_exists(self.admin_path)
+
+    @RestClient.api_get('/{admin_path}/metadata/user?key={userid}',
+                        resp_structure='data > system')
+    def _is_system_user(self, admin_path, userid, request=None):
+        # pylint: disable=unused-argument
+        response = request()
+        return strtobool(response['data']['system'])
+
     def is_system_user(self):
-        return self._is_system_user(self.admin_path)
+        return self._is_system_user(self.admin_path, self.userid)
 
     @RestClient.api_get(
         '/{admin_path}/user',