Bug 1650405

Summary: STS: S3 operations like DeleteBucket/PutObject Denied for RGW-user that assumes role of the primary user
Product: [Red Hat Storage] Red Hat Ceph Storage Reporter: Vidushi Mishra <vimishra>
Component: RGWAssignee: Pritha Srivastava <prsrivas>
Status: CLOSED ERRATA QA Contact: Vidushi Mishra <vimishra>
Severity: high Docs Contact:
Priority: high    
Version: 3.2CC: aemerson, cbodley, ceph-eng-bugs, hnallurv, kbader, mbenjamin, sweil, tserlin
Target Milestone: rc   
Target Release: 3.2   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: RHEL: ceph-12.2.8-48.el7cp Ubuntu: ceph_12.2.8-43redhat1 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-01-03 19:02:22 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Vidushi Mishra 2018-11-16 06:00:27 UTC 
Description of problem:

S3 operations like DeleteBucket/PutObject are denied for the user mentioned as the Principal in the assume role policy doc.


Version-Release number of selected component (if applicable):
ceph version 12.2.8-31redhat1xenial

How reproducible:
3/3

Steps to Reproduce:
1. Create a RGW user(TESTER) and assign admin caps to it for Role creation.
2. Create a role and allow another RGW user (TESTER1) to assume that role.
3. Attach a permission policy to the role which allows all s3 operation for all resources.
4. Do AssumeRole API call using TESTER1 credentials and perform some s3 operations.

Actual results:

S3 operations should not fail for the user that has assumed role and has permission policy for allowing all s3 operations.

Expected results:
S3 ops like deleteBucket and PutObject fail
Comment 4 Vidushi Mishra 2018-11-16 07:24:43 UTC 
In the description of this BZ, please consider the Actual Results as Expected results and Expected results as Actual results.
Comment 7 Adam C. Emerson 2018-11-19 15:53:25 UTC 
Surely, I'll be happy to.
Comment 8 Pritha Srivastava 2018-11-19 15:57:39 UTC 
Matt, Adam, I am already looking into this. This is related to User Policy commits not there in downstream Luminous and few other bugs in user policy code.
Comment 19 errata-xmlrpc 2019-01-03 19:02:22 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:0020