HA+Ubuntu+Ceph for all, RBD, RadosGW
3 controllers, 2 compute+OSD
When trying to connect using S3 API I got "AccessDenied"
Was tried different conbinations of access_key/secret_key, different users was created.
If open into browser or get via curl the link to the bucket (http://controller_IP:8080/bucket_name) - you can see bucket content.
Utilites that was used: dragondisk, s3cmd, s3curl, shell script (attached), boto
VERSION:
feature_groups:
- mirantis
production: "docker"
release: "6.0"
api: "1.0"
build_number: "58"
build_id: "2014-12-26_14-25-46"
astute_sha: "16b252d93be6aaa73030b8100cf8c5ca6a970a91"
fuellib_sha: "fde8ba5e11a1acaf819d402c645c731af450aff0"
ostf_sha: "a9afb68710d809570460c29d6c3293219d3624d4"
nailgun_sha: "5f91157daa6798ff522ca9f6d34e7e135f150a90"
fuelmain_sha: "81d38d6f2903b5a8b4bee79ca45a54b76c1361b8"
HA+Ubuntu+Ceph for all, RBD, RadosGW
3 controllers, 2 compute+OSD
root@node-6:~# radosgw-admin user info --uid=s3test
{ "user_id": "s3test",
"display_name": "S3Test",
"email": "",
"suspended": 0,
"max_buckets": 1000,
"auid": 0,
"subusers": [
{ "id": "s3test:stest",
"permissions": "full-control"}],
"keys": [
{ "user": "s3test",
"access_key": "3VJ8Y2SY5ZSLWQH3UD72",
"secret_key": "pM1\/s45XIJeGkOiOGK+KsY6JTuHGsiaqjjXV+gIW"},
{ "user": "s3test:stest",
"access_key": "RCDESZ0YLK1A5U5G6FA0",
"secret_key": ""}],
"swift_keys": [
{ "user": "s3test:stest",
"secret_key": "fi0XcnOw4piIWRxfr2nmRAh3Y+ru5BgX3lt\/rgm2"}],
"caps": [],
"op_mask": "read, write, delete",
"default_placement": "",
"placement_tags": [],
"bucket_quota": { "enabled": false,
"max_size_kb": -1,
"max_objects": -1},
"user_quota": { "enabled": false,
"max_size_kb": -1,
"max_objects": -1},
"temp_url_keys": []}
root@node-6:~# swift stat -v
StorageURL: http://172.16.0.6:8080/swift/v1
Auth Token: 18c7273dbbd8421b9f97fbfa78a8135a
Account: v1
Containers: 0
Objects: 0
Bytes: 0
Vary: Accept-Encoding
Server: Apache/2.2.22 (Ubuntu)
X-Account-Bytes-Used-Actual: 0
Content-Type: text/plain; charset=utf-8
curl http://172.16.0.6:8080/s3-test
<ListBucketResult xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<Name>s3-test</Name>
<Prefix/>
<Marker/>
<MaxKeys>1000</MaxKeys>
<IsTruncated>false</IsTruncated>
<Contents>
<Key>Selection_167.png</Key>
<LastModified>2015-04-20T10:12:32.000Z</LastModified>
<ETag>"f42cb4f0feda1f90b04d0c47892dd9ef"</ETag>
<Size>187191</Size>
<StorageClass>STANDARD</StorageClass>
<Owner>
<ID>6849069053f745ed8785d205028e161d</ID>
<DisplayName>admin</DisplayName>
</Owner>
</Contents>
</ListBucketResult>
Controller IP 172.16.0.6
HTTP/1.1 403 Forbidden
Date: Tue, 21 Apr 2015 14:30:21 GMT
Server: Apache/2.2.22 (Ubuntu)
Accept-Ranges: bytes
Content-Length: 78
Content-Type: application/xml
<?xml version="1.0" encoding="UTF-8"?><Error><Code>AccessDenied</Code></Error>
was used any of available pair access_key/secret_key
#./s3curl.pl --id 3VJ8Y2SY5ZSLWQH3UD72 --key pM1\/s45XIJeGkOiOGK+KsY6JTuHGsiaqjjXV+gIW -- -s -v http://172.16.0.6:8080
* Rebuilt URL to: http://172.16.0.6:8080/
* Hostname was NOT found in DNS cache
* Trying 172.16.0.6...
* Connected to 172.16.0.6 (172.16.0.6) port 8080 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.35.0
> Host: 172.16.0.6:8080
> Accept: */*
> Date: wed, 22 apr 2015 06:26:33 +0000
> Authorization: AWS 3VJ8Y2SY5ZSLWQH3UD72:H8tLWBajZT2Ry3av55ogFH4Qb6Q=
>
< HTTP/1.1 403 Forbidden
< Date: Wed, 22 Apr 2015 06:26:28 GMT
* Server Apache/2.2.22 (Ubuntu) is not blacklisted
< Server: Apache/2.2.22 (Ubuntu)
< Accept-Ranges: bytes
< Content-Length: 78
< Content-Type: application/xml
<
* Connection #0 to host 172.16.0.6 left intact
<?xml version="1.0" encoding="UTF-8"?><Error><Code>AccessDenied</Code></Error>
script to test swift API attached (test.tar.gz)
./test.sh
Objects in bucket s3-test:
authHeader : JdcitS/plDEMF0WqG2WRpGGEfrg=
authHeader : 3VJ8Y2SY5ZSLWQH3UD72:JdcitS/plDEMF0WqG2WRpGGEfrg=
HTTP/1.1 200 OK
Date: Tue, 21 Apr 2015 14:36:31 GMT
Server: Apache/2.2.22 (Ubuntu)
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/plain; charset=utf-8
Selection_167.png
@Denis, thank you for posting this bug. But I am not sure that this is a bug at all - can you describe the actual sequence of actions you performed and what should have happened if everything was configured correctly according to your expectations?
I see that you are using some custom script to authenticate through s3 api of radosgw, but I am not sure that you are providing correct credentials.
First of all, I cannot understand what test.sh script is actually doing. As far as I see it returned error code 200. What does this mean?
Secondly, there is no code of ./s3curl.pl, so we cannot be sure that s3curl actually passes credentials as S3 API is expecting.
Next, I see that you are using curl to access S3 API without providing any access information. Why do you think it should give you anything than 403/401 error code?
We would really appreciate if you provided more info on this as it would make bugfixing process much easier.
Thank you.