From 07cdc65579d8c60399cdde73fddc26c36190fcde Mon Sep 17 00:00:00 2001 From: Casey Bodley Date: Thu, 29 Feb 2024 13:14:57 -0500 Subject: [PATCH] rgw/auth: WebIdentityApplier doesn't create shadow users for account roles Signed-off-by: Casey Bodley --- src/rgw/rgw_auth.cc | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/rgw/rgw_auth.cc b/src/rgw/rgw_auth.cc index 6fe4083603626..a357d15a9dfd0 100644 --- a/src/rgw/rgw_auth.cc +++ b/src/rgw/rgw_auth.cc @@ -620,6 +620,15 @@ void rgw::auth::WebIdentityApplier::load_acct_info(const DoutPrefixProvider* dpp federated_user.tenant = role_tenant; federated_user.ns = "oidc"; + if (account) { + // we don't need shadow users for account roles because bucket ownership, + // quota, and stats are tracked by the account instead of the user + user_info.user_id = std::move(federated_user); + user_info.display_name = user_name; + user_info.type = TYPE_WEB; + return; + } + std::unique_ptr user = driver->get_user(federated_user); //Check in oidc namespace -- 2.39.5