rgw: add RGWIdentityType::TYPE_ROOT for account root user

Signed-off-by: Casey Bodley <cbodley@redhat.com>
(cherry picked from commit 828aa90a2b0070d043c67464a03529105d835db2)

diff --git a/src/rgw/driver/rados/rgw_data_sync.cc b/src/rgw/driver/rados/rgw_data_sync.cc
index 84e13049319a4956d5dd4e8dafbb3e287c07bc82..4a57a268f08e0d4f42bc93c025b66e68c6920cd2 100644 (file)
--- a/src/rgw/driver/rados/rgw_data_sync.cc
+++ b/src/rgw/driver/rados/rgw_data_sync.cc
@@ -2650,7 +2650,7 @@ class RGWUserPermHandler {
                                                          info->user_info.account_id,
                                                          RGW_PERM_FULL_CONTROL,
                                                          false, /* system_request? */
-                                                         TYPE_RGW);
+                                                         info->user_info.type);
 
       map<string, bufferlist> uattrs;
 

diff --git a/src/rgw/driver/rados/rgw_rest_user.cc b/src/rgw/driver/rados/rgw_rest_user.cc
index 748a61c3f837e7d1a0d451c9bb7a8ab189f2f39b..9f3ae2d03aa76fc049ea5b4c8a6b569326a3e643 100644 (file)
--- a/src/rgw/driver/rados/rgw_rest_user.cc
+++ b/src/rgw/driver/rados/rgw_rest_user.cc
@@ -159,6 +159,7 @@ void RGWOp_User_Create::execute(optional_yield y)
   bool gen_key;
   bool suspended;
   bool system;
+  bool account_root = false;
   bool exclusive;
 
   int32_t max_buckets;
@@ -181,6 +182,7 @@ void RGWOp_User_Create::execute(optional_yield y)
   RESTArgs::get_bool(s, "suspended", false, &suspended);
   RESTArgs::get_int32(s, "max-buckets", default_max_buckets, &max_buckets);
   RESTArgs::get_bool(s, "system", false, &system);
+  RESTArgs::get_bool(s, "account-root", false, &account_root);
   RESTArgs::get_bool(s, "exclusive", false, &exclusive);
   RESTArgs::get_string(s, "op-mask", op_mask_str, &op_mask_str);
   RESTArgs::get_string(s, "default-placement", default_placement_str, &default_placement_str);
@@ -238,6 +240,9 @@ void RGWOp_User_Create::execute(optional_yield y)
   if (s->info.args.exists("system"))
     op_state.set_system(system);
 
+  if (s->info.args.exists("account-root"))
+    op_state.set_account_root(account_root);
+
   if (s->info.args.exists("exclusive"))
     op_state.set_exclusive(exclusive);
 
@@ -303,6 +308,7 @@ void RGWOp_User_Modify::execute(optional_yield y)
   bool gen_key;
   bool suspended;
   bool system;
+  bool account_root = false;
   bool email_set;
   bool quota_set;
   int32_t max_buckets;
@@ -322,6 +328,7 @@ void RGWOp_User_Modify::execute(optional_yield y)
   RESTArgs::get_string(s, "key-type", key_type_str, &key_type_str);
 
   RESTArgs::get_bool(s, "system", false, &system);
+  RESTArgs::get_bool(s, "account-root", false, &account_root);
   RESTArgs::get_string(s, "op-mask", op_mask_str, &op_mask_str);
   RESTArgs::get_string(s, "default-placement", default_placement_str, &default_placement_str);
   RESTArgs::get_string(s, "placement-tags", placement_tags_str, &placement_tags_str);
@@ -375,6 +382,9 @@ void RGWOp_User_Modify::execute(optional_yield y)
   if (s->info.args.exists("system"))
     op_state.set_system(system);
 
+  if (s->info.args.exists("account-root"))
+    op_state.set_account_root(account_root);
+
   if (!op_mask_str.empty()) {
     uint32_t op_mask;
     int ret = rgw_parse_op_type_list(op_mask_str, &op_mask);

diff --git a/src/rgw/driver/rados/rgw_user.cc b/src/rgw/driver/rados/rgw_user.cc
index 33c9424a5eb19f40dfe5b6a50ea6a7afa815b3bc..cef7a6c23656a36c586fef8156ecd9c54ff0ac16 100644 (file)
--- a/src/rgw/driver/rados/rgw_user.cc
+++ b/src/rgw/driver/rados/rgw_user.cc
@@ -160,7 +160,7 @@ static void dump_user_info(Formatter *f, RGWUserInfo &info,
   encode_json("user_quota", info.quota.user_quota, f);
   encode_json("temp_url_keys", info.temp_url_keys, f);
 
-  string user_source_type;
+  std::string_view user_source_type;
   switch ((RGWIdentityType)info.type) {
   case TYPE_RGW:
     user_source_type = "rgw";
@@ -174,6 +174,9 @@ static void dump_user_info(Formatter *f, RGWUserInfo &info,
   case TYPE_NONE:
     user_source_type = "none";
     break;
+  case TYPE_ROOT:
+    user_source_type = "root";
+    break;
   default:
     user_source_type = "none";
     break;
@@ -1712,6 +1715,14 @@ int RGWUser::execute_add(const DoutPrefixProvider *dpp, RGWUserAdminOpState& op_
     // TODO: change account on user's buckets
   }
 
+  if (op_state.account_root) {
+    if (user_info.account_id.empty()) {
+      set_err_msg(err_msg, "account-root user must belong to an account");
+      return -EINVAL;
+    }
+    user_info.type = TYPE_ROOT;
+  }
+
   // update the request
   op_state.set_user_info(user_info);
   op_state.set_populated();
@@ -2020,6 +2031,14 @@ int RGWUser::execute_modify(const DoutPrefixProvider *dpp, RGWUserAdminOpState&
     }
   }
 
+  if (op_state.account_root_specified) {
+    if (op_state.account_root && user_info.account_id.empty()) {
+      set_err_msg(err_msg, "account-root user must belong to an account");
+      return -EINVAL;
+    }
+    user_info.type = op_state.account_root ? TYPE_ROOT : TYPE_RGW;
+  }
+
   op_state.set_user_info(user_info);
 
   // if we're supposed to modify keys, do so

diff --git a/src/rgw/driver/rados/rgw_user.h b/src/rgw/driver/rados/rgw_user.h
index 906917e01e6d909a8672b9e4b6b00e943c31ec28..463857899db5fe10be819383d604668569bc303c 100644 (file)
--- a/src/rgw/driver/rados/rgw_user.h
+++ b/src/rgw/driver/rados/rgw_user.h
@@ -115,6 +115,7 @@ struct RGWUserAdminOpState {
   __u8 suspended{0};
   __u8 admin{0};
   __u8 system{0};
+  __u8 account_root{0};
   __u8 exclusive{0};
   __u8 fetch_stats{0};
   __u8 sync_stats{0};
@@ -163,6 +164,7 @@ struct RGWUserAdminOpState {
   bool suspension_op{false};
   bool admin_specified{false};
   bool system_specified{false};
+  bool account_root_specified{false};
   bool key_op{false};
   bool temp_url_key_specified{false};
   bool found_by_uid{false};
@@ -295,6 +297,11 @@ struct RGWUserAdminOpState {
     system_specified = true;
   }
 
+  void set_account_root(__u8 is_account_root) {
+    account_root = is_account_root;
+    account_root_specified = true;
+  }
+
   void set_exclusive(__u8 is_exclusive) {
     exclusive = is_exclusive;
   }

diff --git a/src/rgw/rgw_admin.cc b/src/rgw/rgw_admin.cc
index eca5e653e1e2babbd1ce3ace33db9d7c9232246d..76d360c33d7f0cbdbacdf6affe60a862f464bf2e 100644 (file)
--- a/src/rgw/rgw_admin.cc
+++ b/src/rgw/rgw_admin.cc
@@ -3435,6 +3435,8 @@ int main(int argc, const char **argv)
   bool admin_specified = false;
   int system = false;
   bool system_specified = false;
+  int account_root = false;
+  bool account_root_specified = false;
   int shard_id = -1;
   bool specified_shard_id = false;
   string client_id;
@@ -3692,6 +3694,8 @@ int main(int argc, const char **argv)
       admin_specified = true;
     } else if (ceph_argparse_binary_flag(args, i, &system, NULL, "--system", (char*)NULL)) {
       system_specified = true;
+    } else if (ceph_argparse_binary_flag(args, i, &account_root, NULL, "--account-root", (char*)NULL)) {
+      account_root_specified = true;
     } else if (ceph_argparse_binary_flag(args, i, &verbose, NULL, "--verbose", (char*)NULL)) {
       // do nothing
     } else if (ceph_argparse_binary_flag(args, i, &staging, NULL, "--staging", (char*)NULL)) {
@@ -6495,6 +6499,9 @@ int main(int argc, const char **argv)
   if (system_specified)
     user_op.set_system(system);
 
+  if (account_root_specified)
+    user_op.set_account_root(account_root);
+
   if (set_perm)
     user_op.set_perm(perm_mask);
 

diff --git a/src/rgw/rgw_auth.h b/src/rgw/rgw_auth.h
index aa95ae154962d093bef4db6417b8ef277a5b2c2e..df5f529e64bc61b5388c07c5c1e50405a3feedbc 100644 (file)
--- a/src/rgw/rgw_auth.h
+++ b/src/rgw/rgw_auth.h
@@ -701,7 +701,7 @@ public:
   }
   void to_str(std::ostream& out) const override;
   void load_acct_info(const DoutPrefixProvider* dpp, RGWUserInfo& user_info) const override; /* out */
-  uint32_t get_identity_type() const override { return TYPE_RGW; }
+  uint32_t get_identity_type() const override { return user_info.type; }
   std::string get_acct_name() const override { return {}; }
   std::string get_subuser() const override { return subuser; }
   const std::string& get_tenant() const override {

diff --git a/src/rgw/rgw_common.cc b/src/rgw/rgw_common.cc
index 5c664df97999bb1385e500d4874016de913851d5..5de470d9281f9aedde0d9a180c6a0f547cf72f4c 100644 (file)
--- a/src/rgw/rgw_common.cc
+++ b/src/rgw/rgw_common.cc
@@ -2815,6 +2815,9 @@ void RGWUserInfo::dump(Formatter *f) const
   case TYPE_NONE:
     user_source_type = "none";
     break;
+  case TYPE_ROOT:
+    user_source_type = "root";
+    break;
   default:
     user_source_type = "none";
     break;
@@ -2869,6 +2872,8 @@ void RGWUserInfo::decode_json(JSONObj *obj)
     type = TYPE_KEYSTONE;
   } else if (user_source_type == "ldap") {
     type = TYPE_LDAP;
+  } else if (user_source_type == "root") {
+    type = TYPE_ROOT;
   } else if (user_source_type == "none") {
     type = TYPE_NONE;
   }

diff --git a/src/rgw/rgw_common.h b/src/rgw/rgw_common.h
index d04f7308239989ee64b61202ffd9dd692d97b197..61005bf4f2bff4b9154050efdb088a5dab5c4c4c 100644 (file)
--- a/src/rgw/rgw_common.h
+++ b/src/rgw/rgw_common.h
@@ -516,6 +516,7 @@ enum RGWIdentityType
   TYPE_LDAP=3,
   TYPE_ROLE=4,
   TYPE_WEB=5,
+  TYPE_ROOT=6, // account root user
 };
 
 void encode_json(const char *name, const rgw_placement_rule& val, ceph::Formatter *f);
@@ -573,8 +574,8 @@ struct RGWUserInfo
   int32_t max_buckets;
   uint32_t op_mask;
   RGWUserCaps caps;
-  __u8 admin;
-  __u8 system;
+  __u8 admin = 0;
+  __u8 system = 0;
   rgw_placement_rule default_placement;
   std::list<std::string> placement_tags;
   std::map<int, std::string> temp_url_keys;
@@ -587,8 +588,6 @@ struct RGWUserInfo
     : suspended(0),
       max_buckets(RGW_DEFAULT_MAX_BUCKETS),
       op_mask(RGW_OP_TYPE_ALL),
-      admin(0),
-      system(0),
       type(TYPE_NONE) {
   }
 

diff --git a/src/rgw/rgw_log.cc b/src/rgw/rgw_log.cc
index 4b5b47836a67056f1f57b36def59518aea82f66a..434af83f019c1bc11dfa2590efbf11abbc9b6410 100644 (file)
--- a/src/rgw/rgw_log.cc
+++ b/src/rgw/rgw_log.cc
@@ -300,6 +300,9 @@ void rgw_format_ops_log_entry(struct rgw_log_entry& entry, Formatter *formatter)
     case TYPE_ROLE:
       formatter->dump_string("authentication_type","STS");
       break;
+    case TYPE_ROOT:
+      formatter->dump_string("authentication_type", "Local Account Root");
+      break;
     default:
       break;
   }

diff --git a/src/rgw/rgw_rest_s3.cc b/src/rgw/rgw_rest_s3.cc
index a132f6a6f842be6cf617ed3954a6258f775f0bf3..9c6ed1552d1fa4ee4a093096ab0aba53652dfb52 100644 (file)
--- a/src/rgw/rgw_rest_s3.cc
+++ b/src/rgw/rgw_rest_s3.cc
@@ -6490,7 +6490,7 @@ rgw::auth::s3::STSEngine::authenticate(
     t_attrs.principal_tags = std::move(token.principal_tags);
     auto apl = role_apl_factory->create_apl_role(cct, s, r, t_attrs);
     return result_t::grant(std::move(apl), completer_factory(token.secret_access_key));
-  } else { // This is for all local users of type TYPE_RGW or TYPE_NONE
+  } else { // This is for all local users of type TYPE_RGW|ROOT|NONE
     string subuser;
     auto apl = local_apl_factory->create_apl_local(cct, s, user->get_info(), subuser, token.perm_mask, std::string(_access_key_id));
     return result_t::grant(std::move(apl), completer_factory(token.secret_access_key));