rgw: make keystone work without admin token(service ac requirement)

Ceph RGW admin credentials must not be a requirement.
Both ec2 auth and keystone token validation work without an admin token.

And the user token verification will use its own token. The only
requirement for the service admin user token is the allow_expired, but
in our case we don't use this parameter.

fixes: https://tracker.ceph.com/issues/68327

Co-authored-by: @kayrus
Signed-off-by: Deepika Upadhyay <deepika.upadhyay@clyso.com>
(cherry picked from commit 55ce1782e159190fd9202b6e270a1a2c470b0626)

diff --git a/src/rgw/rgw_auth_keystone.cc b/src/rgw/rgw_auth_keystone.cc
index 0bcd1a32b0fe4ee91247c2b6ecb76a3915f95e98..fedbe2ea46c40b5728300558586ca6715d4a33e4 100644 (file)
--- a/src/rgw/rgw_auth_keystone.cc
+++ b/src/rgw/rgw_auth_keystone.cc
@@ -83,7 +83,12 @@ admin_token_retry:
     throw -EINVAL;
   }
 
-  validate.append_header("X-Auth-Token", admin_token);
+  if (allow_expired) {
+    validate.append_header("X-Auth-Token", admin_token);
+  } else {
+    validate.append_header("X-Auth-Token", token);
+  }
+
   validate.set_send_length(0);
 
   validate.set_url(url);