From 10ba1b782fc1b737486e463cb83b6c46856d972a Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Wed, 28 Oct 2026 00:33:52 -0700 Subject: [PATCH] vector: carry the full identity through s3vectors auth (#12152) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit vector: keep the full identity in the request context Auth discarded the resolved identity object — the s3tables manager request then re-resolved by name and denied authenticated users their actions, policies, account, and claims. Store the object via SetIdentityInContext so downstream authorization sees it. --- weed/s3api/s3vectors/server.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/weed/s3api/s3vectors/server.go b/weed/s3api/s3vectors/server.go index bcea9907ef..71130c1f50 100644 --- a/weed/s3api/s3vectors/server.go +++ b/weed/s3api/s3vectors/server.go @@ -9,6 +9,7 @@ import ( "github.com/gorilla/mux" "github.com/seaweedfs/seaweedfs/weed/pb/filer_pb" "github.com/seaweedfs/seaweedfs/weed/pb/vector_pb" + "github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants" "github.com/seaweedfs/seaweedfs/weed/s3api/s3err" "github.com/seaweedfs/seaweedfs/weed/s3api/s3tables" ) @@ -90,12 +91,13 @@ func (s *Server) dispatch(w http.ResponseWriter, r *http.Request) { // Auth authenticates the caller and puts the identity in the request context. func (s *Server) Auth(handler http.HandlerFunc) http.HandlerFunc { return func(w http.ResponseWriter, r *http.Request) { - identity, _, errCode := s.authenticator.AuthenticateRequest(r) + identity, identityObj, errCode := s.authenticator.AuthenticateRequest(r) if errCode != s3err.ErrNone { writeError(w, http.StatusForbidden, "AccessDenied", "authentication failed") return } - r = r.WithContext(contextWithIdentity(r.Context(), identity)) + r = r.WithContext(s3_constants.SetIdentityInContext( + contextWithIdentity(r.Context(), identity), identityObj)) handler(w, r) } }