From 01f574d501dbdcb6a00006c3fd43e62872af7882 Mon Sep 17 00:00:00 2001
From: Christian Schwede <cschwede@redhat.com>
Date: Fri, 30 Jan 2026 09:09:55 +0100
Subject: [PATCH] Fix S3 API authentication failures

This change is required as a follow up to [1] and [2]. Recent versions
of Keystone require auth tokens when accessing the /v3/s3tokens Keystone
endpoint.

[1] https://review.opendev.org/c/openstack/keystone/+/966069
[2] https://review.opendev.org/c/openstack/swift/+/966062

Closes-Bug: #2139405
Signed-off-by: Christian Schwede <cschwede@redhat.com>
Change-Id: I55f6e2c68ae7d76b94919ed47df0a2251287e67b
---
 lib/swift | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/swift b/lib/swift
index d4ff8cc196..32aa6d74e1 100644
--- a/lib/swift
+++ b/lib/swift
@@ -434,6 +434,13 @@ function configure_swift {
             swift_pipeline+=" s3token"
             iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token auth_uri ${KEYSTONE_SERVICE_URI_V3}
             iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token delay_auth_decision true
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token secret_cache_duration 900
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token auth_url ${KEYSTONE_SERVICE_URI}
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token project_name 'service'
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token project_domain_name ${SERVICE_DOMAIN_NAME}
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token username 'swift'
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token user_domain_name ${SERVICE_DOMAIN_NAME}
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token password ${SERVICE_PASSWORD}
         fi
         swift_pipeline+=" keystoneauth"
     fi