Re: How to attach permission policy to user?

Pritha Srivastava <prsrivas@xxxxxxxxxx> · Tue, 12 Mar 2019 15:59:15 +0530

What exact error are you seeing after adding admin caps?

I tried the following steps on master and they worked fine: (TESTER1 is adding a user policy to TESTER)
1. radosgw-admin --uid TESTER --display-name "TestUser" --access_key TESTER --secret test123 user create
2. radosgw-admin --uid TESTER1 --display-name "TestUser" --access_key TESTER1 --secret test123 user create
3. radosgw-admin caps add --uid="TESTER1" --caps="user-policy=*"
4. s3curl.pl --debug --id admin -- -s -v -X POST "http://localhost:8000/?Action="">"Version\":\"2012-10-17\",\"Statement\":\[\{\"Effect\":\"Deny\",\"Action\":\"s3:*\",\"Resource\":\[\"*\"\],\"Condition\":\{\"BoolIfExists\":\{\"sts:authentication\":\"false\"\}\}\},\{\"Effect\":\"Allow\",\"Action\":\"sts:GetSessionToken\",\"Resource\":\"*\",\"Condition\":\{\"BoolIfExists\":\{\"sts:authentication\":\"false\"\}\}\}\]\}&Version=2010-05-08"

.s3curl is as follows for me:
%awsSecretAccessKeys = (
    # personal account
    admin => {
        id => 'TESTER1',
        key => 'test123',
    }
);

On Tue, Mar 12, 2019 at 11:09 AM myxingkong <admin@xxxxxxxxxxx> wrote:

Hi Pritha:

I added administrator quotas to users, but they didn't seem to work.

radosgw-admin user create --uid=ADMIN --display-name=ADMIN --admin --system

radosgw-admin caps add --uid="ADMIN" --caps="user-policy=*;roles=*;users=*;buckets=*;metadata=*;usage=*;zone=*"
{
    "user_id": "ADMIN",
    "display_name": "ADMIN",
    "email": "",
    "suspended": 0,
    "max_buckets": 1000,
    "subusers": [],
    "keys": [
        {
            "user": "ADMIN",
            "access_key": "HTRJ1HIKR4FB9A24ZG9C",
            "secret_key": "Dfk7t5u4jvdyFMlEf8t4MTdBLEqVlru7tag1g8PE"
        }
    ],
    "swift_keys": [],
    "caps": [
        {
            "type": "buckets",
            "perm": "*"
        },
        {
            "type": "metadata",
            "perm": "*"
        },
        {
            "type": "roles",
            "perm": "*"
        },
        {
            "type": "usage",
            "perm": "*"
        },
        {
            "type": "user-policy",
            "perm": "*"
        },
        {
            "type": "users",
            "perm": "*"
        },
        {
            "type": "zone",
            "perm": "*"
        }
    ],
    "op_mask": "read, write, delete",
    "system": "true",
    "default_placement": "",
    "default_storage_class": "",
    "placement_tags": [],
    "bucket_quota": {
        "enabled": false,
        "check_on_raw": false,
        "max_size": -1,
        "max_size_kb": 0,
        "max_objects": -1
    },
    "user_quota": {
        "enabled": false,
        "check_on_raw": false,
        "max_size": -1,
        "max_size_kb": 0,
        "max_objects": -1
    },
    "temp_url_keys": [],
    "type": "rgw",
    "mfa_ids": []
}

Thanks,
myxingkong

				发件人： Pritha Srivastava

				发送时间： 2019-03-12 12:23:24

				收件人： 

				myxingkong

				抄送： 

				ceph-users@xxxxxxxxxxxxxx

				主题： Re:  How to attach permission policy to user?

Hi Myxingkong,

Did you add admin caps to the user (with access key id 'HTRJ1HIKR4FB9A24ZG9C'), which is trying to attach a user policy. using the command below:

radosgw-admin caps add --uid=<uid of user> --caps="user-policy=*"

Thanks,

Pritha

On Tue, Mar 12, 2019 at 7:19 AM myxingkong <admin@xxxxxxxxxxx> wrote:

Hi Pritha:

I was unable to attach the permission policy through S3curl, which returned an HTTP 403 error.