.S3 requests no longer rejected if local is listed before external for the authentication order
Previously, S3 requests were rejected when the request is not authenticated successfully by the local authentication engine. As a result, S3 requests using OpenStack Keystone EC2 credentials failed to authenticate with Ceph Object Gateway when the authentication order had local before external
With this fix, S3 requests signed using OpenStack Keystone EC2 credentials successfully authenticate with Ceph Object gateway, even with the authentication order has local listed before external.
Description of problem:
with non-default setting of rgw_s3_auth_order that puts "local" before "external", s3 requests with keystone ec2 credentials fail with:
> 2024-07-19T20:26:54.036+0000 7f18284d2640 20 req 16144285743181518599 0.000000000s s3:list_buckets rgw::auth::s3::LocalEngine rejected with reason=-2028
> 2024-07-19T20:26:54.036+0000 7f18284d2640 20 req 16144285743181518599 0.000000000s s3:list_buckets rgw::auth::s3::AWSAuthStrategy rejected with reason=-2028
> 2024-07-19T20:26:54.036+0000 7f18284d2640 5 req 16144285743181518599 0.000000000s s3:list_buckets Failed the auth strategy, reason=-2028
> 2024-07-19T20:26:54.036+0000 7f18284d2640 10 failed to authorize request
in this case, the local engine's error prevents us from trying the external (keystone) engine, so we return that error directly
Version-Release number of selected component (if applicable):
How reproducible: when keystone is used for s3 auth and rgw_s3_auth_order is reversed
Steps to Reproduce:
1. set up keystone and ec2 credentials
2. configure "rgw_s3_auth_order: sts, local, external"
3. issue s3 requests with ec2 credentials
Actual results:
403 Forbidden (InvalidAccessKeyId)
Expected results:
200 OK
Additional info:
Description of problem: with non-default setting of rgw_s3_auth_order that puts "local" before "external", s3 requests with keystone ec2 credentials fail with: > 2024-07-19T20:26:54.036+0000 7f18284d2640 20 req 16144285743181518599 0.000000000s s3:list_buckets rgw::auth::s3::LocalEngine rejected with reason=-2028 > 2024-07-19T20:26:54.036+0000 7f18284d2640 20 req 16144285743181518599 0.000000000s s3:list_buckets rgw::auth::s3::AWSAuthStrategy rejected with reason=-2028 > 2024-07-19T20:26:54.036+0000 7f18284d2640 5 req 16144285743181518599 0.000000000s s3:list_buckets Failed the auth strategy, reason=-2028 > 2024-07-19T20:26:54.036+0000 7f18284d2640 10 failed to authorize request in this case, the local engine's error prevents us from trying the external (keystone) engine, so we return that error directly Version-Release number of selected component (if applicable): How reproducible: when keystone is used for s3 auth and rgw_s3_auth_order is reversed Steps to Reproduce: 1. set up keystone and ec2 credentials 2. configure "rgw_s3_auth_order: sts, local, external" 3. issue s3 requests with ec2 credentials Actual results: 403 Forbidden (InvalidAccessKeyId) Expected results: 200 OK Additional info: