From: kchheda3 <kchheda3@bloomberg.net>
Date: Fri, 7 Nov 2025 17:35:19 +0000 (-0500)
Subject: rgw/account: Support backward compatibility for s3:PutAcls calls for users migrated... 
X-Git-Tag: v21.0.1~375^2~3
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=55b9bc87d000b95acb870a18d3e74ca6df021ff7;p=ceph.git

rgw/account: Support backward compatibility for s3:PutAcls calls for users migrated to account.

fixes tracker https://tracker.ceph.com/issues/73759

Signed-off-by: kchheda3 <kchheda3@bloomberg.net>
---

diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc
index 34836da3f7e..dc9c624cfa0 100644
--- a/src/rgw/rgw_op.cc
+++ b/src/rgw/rgw_op.cc
@@ -6691,8 +6691,12 @@ void RGWPutACLs::execute(optional_yield y)
   if (op_ret < 0)
     return;
 
+  // only allow acl owner to change if the requester views them as equivalent.
+  // the requester may change between their user id and account id.
   if (!existing_owner.empty() &&
-      existing_owner.id != new_policy.get_owner().id) {
+      existing_owner.id != new_policy.get_owner().id &&
+      !(s->auth.identity->is_owner_of(existing_owner.id) &&
+        s->auth.identity->is_owner_of(new_policy.get_owner().id))) {
     s->err.message = "Cannot modify ACL Owner";
     op_ret = -EPERM;
     return;