Description of problem: with non-default setting of rgw_s3_auth_order that puts "local" before "external", s3 requests with keystone ec2 credentials fail with: > 2024-07-19T20:26:54.036+0000 7f18284d2640 20 req 16144285743181518599 0.000000000s s3:list_buckets rgw::auth::s3::LocalEngine rejected with reason=-2028 > 2024-07-19T20:26:54.036+0000 7f18284d2640 20 req 16144285743181518599 0.000000000s s3:list_buckets rgw::auth::s3::AWSAuthStrategy rejected with reason=-2028 > 2024-07-19T20:26:54.036+0000 7f18284d2640 5 req 16144285743181518599 0.000000000s s3:list_buckets Failed the auth strategy, reason=-2028 > 2024-07-19T20:26:54.036+0000 7f18284d2640 10 failed to authorize request in this case, the local engine's error prevents us from trying the external (keystone) engine, so we return that error directly Version-Release number of selected component (if applicable): How reproducible: when keystone is used for s3 auth and rgw_s3_auth_order is reversed Steps to Reproduce: 1. set up keystone and ec2 credentials 2. configure "rgw_s3_auth_order: sts, local, external" 3. issue s3 requests with ec2 credentials Actual results: 403 Forbidden (InvalidAccessKeyId) Expected results: 200 OK Additional info:
Please specify the severity of this bug. Severity is defined here: https://bugzilla.redhat.com/page.cgi?id=fields.html#bug_severity.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Important: Red Hat Ceph Storage 8.1 security, bug fix, and enhancement updates), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2025:9775
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days