rgw: Adding permission verification to GetSessionToken REST API.

Signed-off-by: Pritha Srivastava <prsrivas@redhat.com>

diff --git a/src/rgw/rgw_rest_sts.cc b/src/rgw/rgw_rest_sts.cc
index bcbd9008c6b79028ad2819f537130ad54c6559a9..6b723aae5d5bce21276ed6546937f72fdf167acc 100644 (file)
--- a/src/rgw/rgw_rest_sts.cc
+++ b/src/rgw/rgw_rest_sts.cc
@@ -169,6 +169,15 @@ void RGWREST_STS::send_response()
 
 int RGWSTSGetSessionToken::verify_permission()
 {
+  rgw::IAM::Partition partition = rgw::IAM::Partition::aws;
+  rgw::IAM::Service service = rgw::IAM::Service::s3;
+  if (!verify_user_permission(this,
+                              s,
+                              rgw::IAM::ARN(partition, service, "", s->user->user_id.tenant, ""),
+                              rgw::IAM::stsGetSessionToken)) {
+    return -EACCES;
+  }
+
   return 0;
 }