From ddf04bb8de83b4edd1962db678cce5c3407aa722 Mon Sep 17 00:00:00 2001 From: Pritha Srivastava Date: Tue, 30 Oct 2018 11:03:40 +0530 Subject: [PATCH] rgw: Adding permission verification to GetSessionToken REST API. Signed-off-by: Pritha Srivastava --- src/rgw/rgw_rest_sts.cc | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/rgw/rgw_rest_sts.cc b/src/rgw/rgw_rest_sts.cc index bcbd9008c6b..6b723aae5d5 100644 --- a/src/rgw/rgw_rest_sts.cc +++ b/src/rgw/rgw_rest_sts.cc @@ -169,6 +169,15 @@ void RGWREST_STS::send_response() int RGWSTSGetSessionToken::verify_permission() { + rgw::IAM::Partition partition = rgw::IAM::Partition::aws; + rgw::IAM::Service service = rgw::IAM::Service::s3; + if (!verify_user_permission(this, + s, + rgw::IAM::ARN(partition, service, "", s->user->user_id.tenant, ""), + rgw::IAM::stsGetSessionToken)) { + return -EACCES; + } + return 0; } -- 2.47.3