RepoMirrors/ceph
1
0
Fork 0
mirror of https://github.com/ceph/ceph synced 2025-01-01 08:32:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

doc/radosgw/STS: sts_key and user capabilities

Browse Source 
- Mention that the `rgw_sts_key` must be exactly 16 characters long and in hex format
- Mention necessary user capabilities for STS and STS Lite

Signed-off-by: Tobias Bossert <tobias.bossert@fastpath.ch>
This commit is contained in:
Tobias Bossert 2022-04-28 08:53:04 +02:00
parent 132d0cb79f
commit af730ab80f
No known key found for this signature in database
GPG Key ID: 21ADDB5608306D9E
2 changed files with 23 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
doc/radosgw/STS.rst
View File

@ -92,20 +92,28 @@ STS Configuration
The following configurable options have to be added for STS integration::
[client.radosgw.gateway]
rgw sts key = {sts key for encrypting the session token}
rgw s3 auth use sts = true
[client.{your-rgw-name}]
rgw_sts_key = {sts key for encrypting the session token}
rgw_s3_auth_use_sts = true
Note: By default, STS and S3 APIs co-exist in the same namespace, and both S3
and STS APIs can be accessed via the same endpoint in Ceph Object Gateway.
Notes:
* By default, STS and S3 APIs co-exist in the same namespace, and both S3
and STS APIs can be accessed via the same endpoint in Ceph Object Gateway.
* The ``rgw_sts_key`` needs to be a hex-string consisting of exactly 16 characters.
Examples
========
1. In order to get the example to work, make sure that the user TESTER has the ``roles`` capability assigned:
1. The following is an example of AssumeRole API call, which shows steps to create a role, assign a policy to it
(that allows access to S3 resources), assuming a role to get temporary credentials and accessing s3 resources using
those credentials. In this example, TESTER1 assumes a role created by TESTER, to access S3 resources owned by TESTER,
according to the permission policy attached to the role.
.. code-block:: console
radosgw-admin caps add --uid="TESTER" --caps="roles=*"
2. The following is an example of AssumeRole API call, which shows steps to create a role, assign a policy to it
(that allows access to S3 resources), assuming a role to get temporary credentials and accessing s3 resources using
those credentials. In this example, TESTER1 assumes a role created by TESTER, to access S3 resources owned by TESTER,
according to the permission policy attached to the role.
.. code-block:: python

12
doc/radosgw/STSLite.rst
View File

@ -60,9 +60,9 @@ The above STS configurables can be used with the Keystone configurables if one
needs to use STS Lite in conjunction with Keystone. The complete set of
configurable options will be::
[client.radosgw.gateway]
rgw sts key = {sts key for encrypting/ decrypting the session token}
rgw s3 auth use sts = true
[client.{your-rgw-name}]
rgw_sts_key = {sts key for encrypting/ decrypting the session token, exactly 16 hex characters}
rgw_s3_auth_use_sts = true
rgw keystone url = {keystone server url:keystone server admin port}
rgw keystone admin project = {keystone admin project name}
@ -81,9 +81,9 @@ The details of the integrating ldap with Ceph Object Gateway can be found here:
The complete set of configurables to use STS Lite with LDAP are::
[client.radosgw.gateway]
rgw sts key = {sts key for encrypting/ decrypting the session token}
rgw s3 auth use sts = true
[client.{your-rgw-name}]
rgw_sts_key = {sts key for encrypting/ decrypting the session token, exactly 16 hex characters}
rgw_s3_auth_use_sts = true
rgw_s3_auth_use_ldap = true
rgw_ldap_uri = {LDAP server to use}