From: Pritha Srivastava Date: Tue, 10 Oct 2023 10:20:52 +0000 (+0530) Subject: rgw/iam: adds implementation for iam AddClientIdToOIDCProvider. X-Git-Tag: v20.0.0~1177^2~5 X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=70e187a8c2a17a2346ca1557ba874253eb2a91fd;p=ceph.git rgw/iam: adds implementation for iam AddClientIdToOIDCProvider. This API provides the mechanism to update the existing client ids for a particular OIDC Provider identified by its arn. fixes: https://tracker.ceph.com/issues/63213 Signed-off-by: Pritha Srivastava --- diff --git a/src/rgw/rgw_iam_policy.cc b/src/rgw/rgw_iam_policy.cc index 1901c6f87cb..b45a9ac3f73 100644 --- a/src/rgw/rgw_iam_policy.cc +++ b/src/rgw/rgw_iam_policy.cc @@ -160,6 +160,7 @@ static const actpair actpairs[] = { "iam:DeleteOIDCProvider", iamDeleteOIDCProvider}, { "iam:GetOIDCProvider", iamGetOIDCProvider}, { "iam:ListOIDCProviders", iamListOIDCProviders}, + { "iam:AddClientIdToOIDCProvider", iamAddClientIdToOIDCProvider}, { "iam:TagRole", iamTagRole}, { "iam:ListRoleTags", iamListRoleTags}, { "iam:UntagRole", iamUntagRole}, @@ -1550,6 +1551,9 @@ const char* action_bit_string(uint64_t action) { case iamListOIDCProviders: return "iam:ListOIDCProviders"; + case iamAddClientIdToOIDCProvider: + return "iam:AddClientIdToOIDCProvider"; + case iamTagRole: return "iam:TagRole"; diff --git a/src/rgw/rgw_iam_policy.h b/src/rgw/rgw_iam_policy.h index 262aeb69149..4c452462e4b 100644 --- a/src/rgw/rgw_iam_policy.h +++ b/src/rgw/rgw_iam_policy.h @@ -143,6 +143,7 @@ enum { iamDeleteOIDCProvider, iamGetOIDCProvider, iamListOIDCProviders, + iamAddClientIdToOIDCProvider, iamTagRole, iamListRoleTags, iamUntagRole, diff --git a/src/rgw/rgw_op_type.h b/src/rgw/rgw_op_type.h index fc661b51dbe..b9f0b785060 100644 --- a/src/rgw/rgw_op_type.h +++ b/src/rgw/rgw_op_type.h @@ -161,5 +161,6 @@ enum RGWOpType { RGW_OP_DELETE_OIDC_PROVIDER, RGW_OP_GET_OIDC_PROVIDER, RGW_OP_LIST_OIDC_PROVIDERS, + RGW_OP_ADD_CLIENTID_TO_OIDC_PROVIDER, }; diff --git a/src/rgw/rgw_rest_iam.cc b/src/rgw/rgw_rest_iam.cc index c6f5a584c70..4c77bc71fa3 100644 --- a/src/rgw/rgw_rest_iam.cc +++ b/src/rgw/rgw_rest_iam.cc @@ -45,6 +45,7 @@ static const std::unordered_map op_generators = {"ListOpenIDConnectProviders", [](const bufferlist& bl_post_body) -> RGWOp* {return new RGWListOIDCProviders;}}, {"GetOpenIDConnectProvider", [](const bufferlist& bl_post_body) -> RGWOp* {return new RGWGetOIDCProvider;}}, {"DeleteOpenIDConnectProvider", [](const bufferlist& bl_post_body) -> RGWOp* {return new RGWDeleteOIDCProvider;}}, + {"AddClientIDToOpenIDConnectProvider", [](const bufferlist& bl_post_body) -> RGWOp* {return new RGWAddClientIdToOIDCProvider;}}, {"TagRole", [](const bufferlist& bl_post_body) -> RGWOp* {return new RGWTagRole(bl_post_body);}}, {"ListRoleTags", [](const bufferlist& bl_post_body) -> RGWOp* {return new RGWListRoleTags;}}, {"UntagRole", [](const bufferlist& bl_post_body) -> RGWOp* {return new RGWUntagRole(bl_post_body);}}, diff --git a/src/rgw/rgw_rest_oidc_provider.cc b/src/rgw/rgw_rest_oidc_provider.cc index 70191879ad1..d29188bba27 100644 --- a/src/rgw/rgw_rest_oidc_provider.cc +++ b/src/rgw/rgw_rest_oidc_provider.cc @@ -333,3 +333,75 @@ void RGWListOIDCProviders::execute(optional_yield y) s->formatter->close_section(); } } + +RGWAddClientIdToOIDCProvider::RGWAddClientIdToOIDCProvider() + : RGWRestOIDCProvider(rgw::IAM::iamAddClientIdToOIDCProvider, RGW_CAP_WRITE) +{ +} + +int RGWAddClientIdToOIDCProvider::init_processing(optional_yield y) +{ + std::string_view account; + if (const auto& acc = s->auth.identity->get_account(); acc) { + account = acc->id; + } else { + account = s->user->get_tenant(); + } + std::string provider_arn = s->info.args.get("OpenIDConnectProviderArn"); + auto ret = validate_provider_arn(provider_arn, account, + resource, url, s->err.message); + if (ret < 0) { + return ret; + } + + client_id = s->info.args.get("ClientID"); + + if (client_id.empty()) { + s->err.message = "Missing required element ClientID"; + ldpp_dout(this, 20) << "ERROR: ClientID is empty" << dendl; + return -EINVAL; + } + + if (client_id.size() > MAX_OIDC_CLIENT_ID_LEN) { + s->err.message = "ClientID cannot exceed the maximum length of " + + std::to_string(MAX_OIDC_CLIENT_ID_LEN); + ldpp_dout(this, 20) << "ERROR: ClientID length exceeded " << MAX_OIDC_CLIENT_ID_LEN << dendl; + return -EINVAL; + } + + return 0; +} + +void RGWAddClientIdToOIDCProvider::execute(optional_yield y) +{ + RGWOIDCProviderInfo info; + op_ret = driver->load_oidc_provider(this, y, resource.account, url, info); + + if (op_ret < 0) { + if (op_ret != -ENOENT && op_ret != -EINVAL) { + op_ret = ERR_INTERNAL_ERROR; + } + return; + } + + if(std::find(info.client_ids.begin(), info.client_ids.end(), client_id) != info.client_ids.end()) { + op_ret = -EEXIST; + } else { + + info.client_ids.emplace_back(client_id); + + constexpr bool exclusive = false; + op_ret = driver->store_oidc_provider(this, y, info, exclusive); + } + if (op_ret == 0 || op_ret == -EEXIST) { + op_ret = 0; + s->formatter->open_object_section("AddClientIDToOpenIDConnectProviderResponse"); + s->formatter->open_object_section("ResponseMetadata"); + s->formatter->dump_string("RequestId", s->trans_id); + s->formatter->close_section(); + s->formatter->open_object_section("AddClientIDToOpenIDConnectProviderResponse"); + dump_oidc_provider(info, s->formatter); + s->formatter->close_section(); + s->formatter->close_section(); + } +} diff --git a/src/rgw/rgw_rest_oidc_provider.h b/src/rgw/rgw_rest_oidc_provider.h index 192906ab498..9a49ed7dafb 100644 --- a/src/rgw/rgw_rest_oidc_provider.h +++ b/src/rgw/rgw_rest_oidc_provider.h @@ -62,3 +62,15 @@ class RGWListOIDCProviders : public RGWRestOIDCProvider { const char* name() const override { return "list_oidc_providers"; } RGWOpType get_type() override { return RGW_OP_LIST_OIDC_PROVIDERS; } }; + +class RGWAddClientIdToOIDCProvider : public RGWRestOIDCProvider { + std::string url; + std::string client_id; +public: + RGWAddClientIdToOIDCProvider(); + + int init_processing(optional_yield y); + void execute(optional_yield y) override; + const char* name() const override { return "add_client_id_to_oidc_provider"; } + RGWOpType get_type() override { return RGW_OP_ADD_CLIENTID_TO_OIDC_PROVIDER; } +}; \ No newline at end of file