rgw: Code for making STS Key configurable.

Signed-off-by: Pritha Srivastava <prsrivas@redhat.com>

diff --git a/src/common/legacy_config_opts.h b/src/common/legacy_config_opts.h
index 76ec765113b18e58a72fd91f617cfb5654ab1c2e..7fca815d8f2bc74a9779c63b6d91d1b8edcebcc8 100644 (file)
--- a/src/common/legacy_config_opts.h
+++ b/src/common/legacy_config_opts.h
@@ -1546,3 +1546,4 @@ OPTION(rgw_cors_rules_max_num, OPT_INT) // According to AWS S3(http://docs.aws.a
 OPTION(rgw_delete_multi_obj_max_num, OPT_INT) // According to AWS S3(https://docs.aws.amazon.com/AmazonS3/latest/dev/DeletingObjects.html), Amazon S3 also provides the Multi-Object Delete API that you can use to delete up to 1000 objects in a single HTTP request.
 OPTION(rgw_website_routing_rules_max_num, OPT_INT) // According to AWS S3, An website routing config can have up to 50 rules.
 OPTION(rgw_sts_entry, OPT_STR)
+OPTION(rgw_sts_key, OPT_STR)

diff --git a/src/common/options.cc b/src/common/options.cc
index f8a7390a106433874f5854906853aef9de1c680a..10006540e0c8d22669045a5760ca7ba386f132a0 100644 (file)
--- a/src/common/options.cc
+++ b/src/common/options.cc
@@ -6351,7 +6351,13 @@ std::vector<Option> get_rgw_options() {
     Option("rgw_sts_entry", Option::TYPE_STR, Option::LEVEL_ADVANCED)
     .set_default("sts")
     .set_description("STS URL prefix")
-    .set_long_description("URL path prefix for internal STS requests.")
+    .set_long_description("URL path prefix for internal STS requests."),
+
+    Option("rgw_sts_key", Option::TYPE_STR, Option::LEVEL_ADVANCED)
+    .set_default("sts")
+    .set_description("STS Key")
+    .set_long_description("Key used for encrypting/ decrypting session token.")
+
   });
 }
 

diff --git a/src/rgw/rgw_sts.cc b/src/rgw/rgw_sts.cc
index 78bd5da765323e9d45005e234d3f54ea4d995542..813804507c05b5aa3e6b40d3144bb302c0d02b3b 100644 (file)
--- a/src/rgw/rgw_sts.cc
+++ b/src/rgw/rgw_sts.cc
@@ -64,11 +64,8 @@ int Credentials::generateCredentials(CephContext* cct,
   if (! cryptohandler) {
     return -EINVAL;
   }
-  char secret_s[] = {
-    0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
-    0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
-  };
-  buffer::ptr secret(secret_s, sizeof(secret_s));
+  string secret_s = cct->_conf->rgw_sts_key;
+  buffer::ptr secret(secret_s.c_str(), secret_s.length());
   int ret = 0;
   if (ret = cryptohandler->validate_secret(secret); ret < 0) {
     ldout(cct, 0) << "ERROR: Invalid secret key" << dendl;