452d2fc6f3
Fix Swift3 never to send "Authorization" header again after the initial authentication at S3AclRequest with keystone authentication. This problem occurs following operations which check permission of object. - HEAD Object - GET Object - PUT Object Copy - Upload Part Copy The keystone authentication expects both a token generated by _canonical_string() and an user name written in the "Authorization" header. S3AclRequest will bypass the keystone authentication process after authenticate() method call for some reasons (e.g. performance and object acl). To bypass the authentication, Swift3 has a couple of things to do. One is to delete "Authentication" header. The other is to keep (and pass) a token retrieved from keystone server.(NOTE: the token is different from a token generated by _canonical_string()) However, current Swift3 still tries to keep the "Authorization" header in Request class and might pass it to the keystone authentication. It causes unexpected (unnecessary) authentication failure. To prevent the failure, Swift3 should delete the "Authentication" header explicitly from Request.headers. Change-Id: Id81e393d51b389610d9fa470f307f61e846a78a3
Swift3
Swift3 Middleware for OpenStack Swift, allowing access to OpenStack swift via the Amazon S3 API.
Install
-
Install Swift3 with
sudo python setup.py installorsudo python setup.py developor via whatever packaging system you may be using. -
Alter your proxy-server.conf pipeline to have swift3:
If you use tempauth:
Was::
[pipeline:main]
pipeline = catch_errors cache tempauth proxy-server
Change To::
[pipeline:main]
pipeline = catch_errors cache swift3 tempauth proxy-server
If you use keystone:
Was::
[pipeline:main]
pipeline = catch_errors cache authtoken keystone proxy-server
Change To::
[pipeline:main]
pipeline = catch_errors cache swift3 s3token authtoken keystoneauth proxy-server
Note that swift3 explicitly checks that keystoneauth is in the pipeline. You must use this name in the pipeline statement and in [filter:keystoneauth] section header.
-
Add to your proxy-server.conf the section for the Swift3 WSGI filter::
[filter:swift3] use = egg:swift3#swift3
You also need to add the following if you use keystone (adjust port, host, protocol configurations for your environment):
[filter:s3token]
paste.filter_factory = keystoneclient.middleware.s3_token:filter_factory
auth_port = 35357
auth_host = 127.0.0.1
auth_protocol = http