From 9057e70d60bf3c22845f2b5e38a2a2633dfbb322 Mon Sep 17 00:00:00 2001 From: Casey Bodley Date: Wed, 6 Mar 2024 18:37:37 -0500 Subject: [PATCH] rgw/auth: log each policy that returns Allow or Deny makes it much easier to debug authorization issues when you can see exactly which policies led to success/failure Signed-off-by: Casey Bodley --- src/rgw/rgw_common.cc | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src/rgw/rgw_common.cc b/src/rgw/rgw_common.cc index 689165f5a4eb7..e8951e148fc65 100644 --- a/src/rgw/rgw_common.cc +++ b/src/rgw/rgw_common.cc @@ -1136,12 +1136,16 @@ Effect eval_identity_or_session_policies(const DoutPrefixProvider* dpp, const ARN& arn) { auto policy_res = Effect::Pass, prev_res = Effect::Pass; for (auto& policy : policies) { - if (policy_res = eval_or_pass(dpp, policy, env, boost::none, op, arn); policy_res == Effect::Deny) + if (policy_res = eval_or_pass(dpp, policy, env, boost::none, op, arn); + policy_res == Effect::Deny) { + ldpp_dout(dpp, 10) << __func__ << " Deny from " << policy << dendl; return policy_res; - else if (policy_res == Effect::Allow) + } else if (policy_res == Effect::Allow) { + ldpp_dout(dpp, 20) << __func__ << " Allow from " << policy << dendl; prev_res = Effect::Allow; - else if (policy_res == Effect::Pass && prev_res == Effect::Allow) + } else if (policy_res == Effect::Pass && prev_res == Effect::Allow) { policy_res = Effect::Allow; + } } return policy_res; } -- 2.39.5