Re: unauthorized to list radosgw swift container objects

"B, Naga Venkata" <naga.b@xxxxxxx> · Mon, 12 Sep 2016 18:25:27 +0000

If somebody hit this issue, this can be resolved by creating subuser as
radosgw-admin subuser create --uid=s3User --subuser="s3User:swiftUser" --access=full

Thanks & Regards,
Naga Venkata

From: ceph-users [mailto:ceph-users-bounces@xxxxxxxxxxxxxx]
On Behalf Of B, Naga Venkata

Sent: Friday, September 09, 2016 2:00 PM

To: ceph-users@xxxxxxxxxxxxxx

Subject:  unauthorized to list radosgw swift container objects

Hi all,

After upgrade from firefly(0.80.7) to hammer(0.94.7), I am unable to list objects in containers for radosgw swift user and I am able to list containers for the
 same user.

I have created the user using

radosgw-admin user create --subuser=s3User:swiftUser --display-name="First User" --key-type=swift --access=full

stack@m1-mgmt:~$ swift -V 1.0 -A
http://192.17.16.5:8079/auth -U "s3User:swiftUser" -K "VG+OJoRtloR7AhsD3xsQRi5ug2V5SidqgTpbZe0x" list
test3
test4
test5

stack@m1-mgmt:~$ swift -V 1.0 -A
http://192.17.16.5:8079/auth -U "s3User:swiftUser" -K "VG+OJoRtloR7AhsD3xsQRi5ug2V5SidqgTpbZe0x" list test3
Container GET failed:
http://192.17.16.5:8079/swift/v1/test3?format=json 401 Unauthorized   {"Code":"AccessDenied"}

I am seeing the below logs in radosgw.log

2016-09-09 08:02:24.594110 7f89a67e4700  1 ====== starting new request req=0x7f89b803b430 =====
2016-09-09 08:02:24.594128 7f89a67e4700  2 req 91413:0.000018::GET /swift/v1/test3::initializing for trans_id = tx000000000000000016515-0057d26c90-5f24-default
2016-09-09 08:02:24.594133 7f89a67e4700 10 host=192.17.16.5
2016-09-09 08:02:24.594134 7f89a67e4700 20 subdomain= domain= in_hosted_domain=0
2016-09-09 08:02:24.594169 7f89a67e4700 10 ver=v1 first=test3 req=
2016-09-09 08:02:24.594173 7f89a67e4700 10 s->object=<NULL> s->bucket=test3
2016-09-09 08:02:24.594178 7f89a67e4700  2 req 91413:0.000068:swift:GET /swift/v1/test3::getting op
2016-09-09 08:02:24.594182 7f89a67e4700  2 req 91413:0.000072:swift:GET /swift/v1/test3:list_bucket:authorizing
2016-09-09 08:02:24.594243 7f89a67e4700 10 swift_user=s3User:swiftUser
2016-09-09 08:02:24.594271 7f89a67e4700 20 build_token token=100000007333557365723a737769667455736572ea8442e3530b7e4f10bed3573a113723
2016-09-09 08:02:24.594372 7f89a67e4700  2 req 91413:0.000262:swift:GET /swift/v1/test3:list_bucket:reading permissions
2016-09-09 08:02:24.594418 7f89a67e4700 15 Read AccessControlPolicy<AccessControlPolicy xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Owner><ID>s3User</ID><DisplayName>First
 User</DisplayName></Owner><AccessControlList><Grant><Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser"><ID>s3User</ID><DisplayName>First User</DisplayName></Grantee><Permission>FULL_CONTROL</Permission></Grant></AccessControlList></AccessControlPolicy>
2016-09-09 08:02:24.594437 7f89a67e4700  2 req 91413:0.000327:swift:GET /swift/v1/test3:list_bucket:init op
2016-09-09 08:02:24.594441 7f89a67e4700  2 req 91413:0.000331:swift:GET /swift/v1/test3:list_bucket:verifying op mask
2016-09-09 08:02:24.594449 7f89a67e4700 20 required_mask= 1 user.op_mask=7
2016-09-09 08:02:24.594451 7f89a67e4700  2 req 91413:0.000341:swift:GET /swift/v1/test3:list_bucket:verifying op permissions
2016-09-09 08:02:24.594492 7f89a67e4700  2 req 91413:0.000382:swift:GET /swift/v1/test3:list_bucket:http status=401
2016-09-09 08:02:24.594496 7f89a67e4700  1 ====== req done req=0x7f89b803b430 http_status=401 ======
2016-09-09 08:02:24.594515 7f89a67e4700 20 process_request() returned -13

Can someone help me on this issue?

Thanks & Regards,
Naga Venkata

_______________________________________________
ceph-users mailing list
ceph-users@xxxxxxxxxxxxxx
http://lists.ceph.com/listinfo.cgi/ceph-users-ceph.com