Revert "Implement IAM propagation to S3 servers (#8130)"

This reverts commit 551a31e156.
2026-09-20 13:30:46 +02:00 · 2026-01-27 15:00:17 -08:00
parent 6389a40088
commit 62c4ef3536
26 changed files with 1206 additions and 1726 deletions
@@ -2,6 +2,8 @@ package s3api

 import (
 	"context"
+	"fmt"
+	"net/url"

 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
@@ -36,7 +38,92 @@ func (s3a *S3ApiServer) RemoveIdentity(ctx context.Context, req *iam_pb.RemoveId
 	return &iam_pb.RemoveIdentityResponse{}, nil
 }

+func (s3a *S3ApiServer) executeAction(ctx context.Context, values url.Values) (interface{}, error) {
+	if s3a.embeddedIam == nil {
+		return nil, fmt.Errorf("embedded iam is disabled")
+	}
+	response, iamErr := s3a.embeddedIam.ExecuteAction(ctx, values)
+	if iamErr != nil {
+		return nil, fmt.Errorf("IAM error: %s - %v", iamErr.Code, iamErr.Error)
+	}
+	return response, nil
+}
+
+func (s3a *S3ApiServer) ListUsers(ctx context.Context, req *iam_pb.ListUsersRequest) (*iam_pb.ListUsersResponse, error) {
+	if req == nil {
+		return nil, status.Errorf(codes.InvalidArgument, "request is nil")
+	}
+	values := url.Values{}
+	values.Set("Action", "ListUsers")
+	resp, err := s3a.executeAction(ctx, values)
+	if err != nil {
+		return nil, err
+	}
+	iamResp, ok := resp.(iamListUsersResponse)
+	if !ok {
+		return nil, fmt.Errorf("unexpected IAM ListUsers response type %T", resp)
+	}
+	var usernames []string
+	for _, user := range iamResp.ListUsersResult.Users {
+		if user != nil && user.UserName != nil {
+			usernames = append(usernames, *user.UserName)
+		}
+	}
+	return &iam_pb.ListUsersResponse{Usernames: usernames}, nil
+}
+
+func (s3a *S3ApiServer) CreateUser(ctx context.Context, req *iam_pb.CreateUserRequest) (*iam_pb.CreateUserResponse, error) {
+	if req == nil {
+		return nil, status.Errorf(codes.InvalidArgument, "request is nil")
+	}
+	if req.Identity == nil || req.Identity.Name == "" {
+		return nil, fmt.Errorf("username name is required")
+	}
+	values := url.Values{}
+	values.Set("Action", "CreateUser")
+	values.Set("UserName", req.Identity.Name)
+	_, err := s3a.executeAction(ctx, values)
+	if err != nil {
+		return nil, err
+	}
+	return &iam_pb.CreateUserResponse{}, nil
+}
+
+func (s3a *S3ApiServer) GetUser(ctx context.Context, req *iam_pb.GetUserRequest) (*iam_pb.GetUserResponse, error) {
+	if req == nil {
+		return nil, status.Errorf(codes.InvalidArgument, "request is nil")
+	}
+	if req.Username == "" {
+		return nil, status.Errorf(codes.InvalidArgument, "username is required")
+	}
+	values := url.Values{}
+	values.Set("Action", "GetUser")
+	values.Set("UserName", req.Username)
+	resp, err := s3a.executeAction(ctx, values)
+	if err != nil {
+		return nil, err
+	}
+	iamResp, ok := resp.(iamGetUserResponse)
+	if !ok {
+		return nil, fmt.Errorf("unexpected IAM GetUser response type %T", resp)
+	}
+
+	var username string
+	if iamResp.GetUserResult.User.UserName != nil {
+		username = *iamResp.GetUserResult.User.UserName
+	}
+
+	return &iam_pb.GetUserResponse{
+		Identity: &iam_pb.Identity{
+			Name: username,
+		},
+	}, nil
+}
+
 func (s3a *S3ApiServer) PutPolicy(ctx context.Context, req *iam_pb.PutPolicyRequest) (*iam_pb.PutPolicyResponse, error) {
+	if req == nil {
+		return nil, status.Errorf(codes.InvalidArgument, "request is nil")
+	}
 	if req.Name == "" {
 		return nil, status.Errorf(codes.InvalidArgument, "policy name is required")
 	}
@@ -58,6 +145,9 @@ func (s3a *S3ApiServer) PutPolicy(ctx context.Context, req *iam_pb.PutPolicyRequ
 }

 func (s3a *S3ApiServer) DeletePolicy(ctx context.Context, req *iam_pb.DeletePolicyRequest) (*iam_pb.DeletePolicyResponse, error) {
+	if req == nil {
+		return nil, status.Errorf(codes.InvalidArgument, "request is nil")
+	}
 	if req.Name == "" {
 		return nil, status.Errorf(codes.InvalidArgument, "policy name is required")
 	}
@@ -76,6 +166,9 @@ func (s3a *S3ApiServer) DeletePolicy(ctx context.Context, req *iam_pb.DeletePoli
 }

 func (s3a *S3ApiServer) GetPolicy(ctx context.Context, req *iam_pb.GetPolicyRequest) (*iam_pb.GetPolicyResponse, error) {
+	if req == nil {
+		return nil, status.Errorf(codes.InvalidArgument, "request is nil")
+	}
 	if req.Name == "" {
 		return nil, status.Errorf(codes.InvalidArgument, "policy name is required")
 	}
@@ -84,22 +177,320 @@ func (s3a *S3ApiServer) GetPolicy(ctx context.Context, req *iam_pb.GetPolicyRequ
 	}
 	policy, err := s3a.iam.GetPolicy(req.Name)
 	if err != nil {
-		return &iam_pb.GetPolicyResponse{}, nil // Not found is fine for cache
+		return nil, status.Errorf(codes.NotFound, "policy not found: %s", req.Name)
 	}
 	return &iam_pb.GetPolicyResponse{
-		Name:    policy.Name,
-		Content: policy.Content,
+		Policy: &iam_pb.Policy{
+			Name:    req.Name,
+			Content: policy,
+		},
 	}, nil
 }

 func (s3a *S3ApiServer) ListPolicies(ctx context.Context, req *iam_pb.ListPoliciesRequest) (*iam_pb.ListPoliciesResponse, error) {
+	if req == nil {
+		return nil, status.Errorf(codes.InvalidArgument, "request is nil")
+	}
 	resp := &iam_pb.ListPoliciesResponse{}
 	if s3a.iam == nil {
 		return nil, status.Errorf(codes.Internal, "IAM not initialized")
 	}
-	policies := s3a.iam.ListPolicies()
-	for _, policy := range policies {
-		resp.Policies = append(resp.Policies, policy)
-	}
+	// TODO: Iterate over policies in map?
 	return resp, nil
 }
+
+func (s3a *S3ApiServer) UpdateUser(ctx context.Context, req *iam_pb.UpdateUserRequest) (*iam_pb.UpdateUserResponse, error) {
+	if req == nil {
+		return nil, status.Errorf(codes.InvalidArgument, "request is nil")
+	}
+	if req.Username == "" {
+		return nil, fmt.Errorf("username is required")
+	}
+	values := url.Values{}
+	values.Set("Action", "UpdateUser")
+	values.Set("UserName", req.Username)
+	// UpdateUser in DoActions expects "NewUserName" if renaming, but CreateUser just takes UserName.
+	// Looking at s3api_embedded_iam.go, UpdateUser uses "NewUserName" to change name.
+	if req.Identity != nil && req.Identity.Name != "" {
+		values.Set("NewUserName", req.Identity.Name)
+	}
+	_, err := s3a.executeAction(ctx, values)
+	if err != nil {
+		return nil, err
+	}
+	return &iam_pb.UpdateUserResponse{}, nil
+}
+
+func (s3a *S3ApiServer) DeleteUser(ctx context.Context, req *iam_pb.DeleteUserRequest) (*iam_pb.DeleteUserResponse, error) {
+	if req == nil {
+		return nil, status.Errorf(codes.InvalidArgument, "request is nil")
+	}
+	if req.Username == "" {
+		return nil, fmt.Errorf("username is required")
+	}
+	values := url.Values{}
+	values.Set("Action", "DeleteUser")
+	values.Set("UserName", req.Username)
+	_, err := s3a.executeAction(ctx, values)
+	if err != nil {
+		return nil, err
+	}
+	return &iam_pb.DeleteUserResponse{}, nil
+}
+
+func (s3a *S3ApiServer) ListAccessKeys(ctx context.Context, req *iam_pb.ListAccessKeysRequest) (*iam_pb.ListAccessKeysResponse, error) {
+	if req == nil {
+		return nil, status.Errorf(codes.InvalidArgument, "request is nil")
+	}
+	if req.Username == "" {
+		return nil, fmt.Errorf("username is required")
+	}
+	values := url.Values{}
+	values.Set("Action", "ListAccessKeys")
+	values.Set("UserName", req.Username)
+	resp, err := s3a.executeAction(ctx, values)
+	if err != nil {
+		return nil, err
+	}
+	iamResp, ok := resp.(iamListAccessKeysResponse)
+	if !ok {
+		return nil, fmt.Errorf("unexpected IAM ListAccessKeys response type %T", resp)
+	}
+	var accessKeys []*iam_pb.Credential
+	for _, meta := range iamResp.ListAccessKeysResult.AccessKeyMetadata {
+		if meta != nil && meta.AccessKeyId != nil && meta.Status != nil {
+			accessKeys = append(accessKeys, &iam_pb.Credential{
+				AccessKey: *meta.AccessKeyId,
+				Status:    *meta.Status,
+			})
+		}
+	}
+	return &iam_pb.ListAccessKeysResponse{AccessKeys: accessKeys}, nil
+}
+
+func (s3a *S3ApiServer) CreateAccessKey(ctx context.Context, req *iam_pb.CreateAccessKeyRequest) (*iam_pb.CreateAccessKeyResponse, error) {
+	if req == nil {
+		return nil, status.Errorf(codes.InvalidArgument, "request is nil")
+	}
+	if req.Username == "" {
+		return nil, fmt.Errorf("username is required")
+	}
+	values := url.Values{}
+	values.Set("Action", "CreateAccessKey")
+	values.Set("UserName", req.Username)
+	_, err := s3a.executeAction(ctx, values)
+	if err != nil {
+		return nil, err
+	}
+	return &iam_pb.CreateAccessKeyResponse{}, nil
+}
+
+func (s3a *S3ApiServer) DeleteAccessKey(ctx context.Context, req *iam_pb.DeleteAccessKeyRequest) (*iam_pb.DeleteAccessKeyResponse, error) {
+	if req == nil {
+		return nil, status.Errorf(codes.InvalidArgument, "request is nil")
+	}
+	if req.Username == "" {
+		return nil, fmt.Errorf("username is required")
+	}
+	if req.AccessKey == "" {
+		return nil, fmt.Errorf("access key is required")
+	}
+	values := url.Values{}
+	values.Set("Action", "DeleteAccessKey")
+	values.Set("UserName", req.Username)
+	values.Set("AccessKeyId", req.AccessKey)
+	_, err := s3a.executeAction(ctx, values)
+	if err != nil {
+		return nil, err
+	}
+	return &iam_pb.DeleteAccessKeyResponse{}, nil
+}
+
+func (s3a *S3ApiServer) PutUserPolicy(ctx context.Context, req *iam_pb.PutUserPolicyRequest) (*iam_pb.PutUserPolicyResponse, error) {
+	if req == nil {
+		return nil, status.Errorf(codes.InvalidArgument, "request is nil")
+	}
+	if req.Username == "" {
+		return nil, fmt.Errorf("username is required")
+	}
+	if req.PolicyName == "" {
+		return nil, fmt.Errorf("policy name is required")
+	}
+	values := url.Values{}
+	values.Set("Action", "PutUserPolicy")
+	values.Set("UserName", req.Username)
+	values.Set("PolicyName", req.PolicyName)
+	values.Set("PolicyDocument", req.PolicyDocument)
+	_, err := s3a.executeAction(ctx, values)
+	if err != nil {
+		return nil, err
+	}
+	return &iam_pb.PutUserPolicyResponse{}, nil
+}
+
+func (s3a *S3ApiServer) GetUserPolicy(ctx context.Context, req *iam_pb.GetUserPolicyRequest) (*iam_pb.GetUserPolicyResponse, error) {
+	if req == nil {
+		return nil, status.Errorf(codes.InvalidArgument, "request is nil")
+	}
+	if req.Username == "" {
+		return nil, fmt.Errorf("username is required")
+	}
+	if req.PolicyName == "" {
+		return nil, fmt.Errorf("policy name is required")
+	}
+	values := url.Values{}
+	values.Set("Action", "GetUserPolicy")
+	values.Set("UserName", req.Username)
+	values.Set("PolicyName", req.PolicyName)
+	resp, err := s3a.executeAction(ctx, values)
+	if err != nil {
+		return nil, err
+	}
+	iamResp, ok := resp.(iamGetUserPolicyResponse)
+	if !ok {
+		return nil, fmt.Errorf("unexpected IAM GetUserPolicy response type %T", resp)
+	}
+	return &iam_pb.GetUserPolicyResponse{
+		Username:       iamResp.GetUserPolicyResult.UserName,
+		PolicyName:     iamResp.GetUserPolicyResult.PolicyName,
+		PolicyDocument: iamResp.GetUserPolicyResult.PolicyDocument,
+	}, nil
+}
+
+func (s3a *S3ApiServer) DeleteUserPolicy(ctx context.Context, req *iam_pb.DeleteUserPolicyRequest) (*iam_pb.DeleteUserPolicyResponse, error) {
+	if req == nil {
+		return nil, status.Errorf(codes.InvalidArgument, "request is nil")
+	}
+	if req.Username == "" {
+		return nil, fmt.Errorf("username is required")
+	}
+	if req.PolicyName == "" {
+		return nil, fmt.Errorf("policy name is required")
+	}
+	values := url.Values{}
+	values.Set("Action", "DeleteUserPolicy")
+	values.Set("UserName", req.Username)
+	values.Set("PolicyName", req.PolicyName)
+	_, err := s3a.executeAction(ctx, values)
+	if err != nil {
+		return nil, err
+	}
+	return &iam_pb.DeleteUserPolicyResponse{}, nil
+}
+
+func (s3a *S3ApiServer) ListServiceAccounts(ctx context.Context, req *iam_pb.ListServiceAccountsRequest) (*iam_pb.ListServiceAccountsResponse, error) {
+	if req == nil {
+		return nil, status.Errorf(codes.InvalidArgument, "request is nil")
+	}
+	values := url.Values{}
+	values.Set("Action", "ListServiceAccounts")
+	resp, err := s3a.executeAction(ctx, values)
+	if err != nil {
+		return nil, err
+	}
+	iamResp, ok := resp.(iamListServiceAccountsResponse)
+	if !ok {
+		return nil, fmt.Errorf("unexpected IAM ListServiceAccounts response type %T", resp)
+	}
+	var serviceAccounts []*iam_pb.ServiceAccount
+	for _, sa := range iamResp.ListServiceAccountsResult.ServiceAccounts {
+		if sa != nil {
+			serviceAccounts = append(serviceAccounts, &iam_pb.ServiceAccount{
+				Id:          sa.ServiceAccountId,
+				ParentUser:  sa.ParentUser,
+				Description: sa.Description,
+				Credential: &iam_pb.Credential{
+					AccessKey: sa.AccessKeyId,
+					Status:    sa.Status,
+				},
+			})
+		}
+	}
+	return &iam_pb.ListServiceAccountsResponse{ServiceAccounts: serviceAccounts}, nil
+}
+
+func (s3a *S3ApiServer) CreateServiceAccount(ctx context.Context, req *iam_pb.CreateServiceAccountRequest) (*iam_pb.CreateServiceAccountResponse, error) {
+	if req == nil {
+		return nil, status.Errorf(codes.InvalidArgument, "request is nil")
+	}
+	if req.ServiceAccount == nil || req.ServiceAccount.CreatedBy == "" {
+		return nil, fmt.Errorf("service account owner is required")
+	}
+	values := url.Values{}
+	values.Set("Action", "CreateServiceAccount")
+	values.Set("CreatedBy", req.ServiceAccount.CreatedBy)
+	_, err := s3a.executeAction(ctx, values)
+	if err != nil {
+		return nil, err
+	}
+	return &iam_pb.CreateServiceAccountResponse{}, nil
+}
+
+func (s3a *S3ApiServer) UpdateServiceAccount(ctx context.Context, req *iam_pb.UpdateServiceAccountRequest) (*iam_pb.UpdateServiceAccountResponse, error) {
+	if req == nil {
+		return nil, status.Errorf(codes.InvalidArgument, "request is nil")
+	}
+	if req.Id == "" {
+		return nil, fmt.Errorf("service account id is required")
+	}
+	values := url.Values{}
+	values.Set("Action", "UpdateServiceAccount")
+	values.Set("ServiceAccountId", req.Id)
+	if req.ServiceAccount != nil && req.ServiceAccount.Disabled {
+		values.Set("Status", "Inactive")
+	}
+	_, err := s3a.executeAction(ctx, values)
+	if err != nil {
+		return nil, err
+	}
+	return &iam_pb.UpdateServiceAccountResponse{}, nil
+}
+
+func (s3a *S3ApiServer) DeleteServiceAccount(ctx context.Context, req *iam_pb.DeleteServiceAccountRequest) (*iam_pb.DeleteServiceAccountResponse, error) {
+	if req == nil {
+		return nil, status.Errorf(codes.InvalidArgument, "request is nil")
+	}
+	if req.Id == "" {
+		return nil, fmt.Errorf("service account id is required")
+	}
+	values := url.Values{}
+	values.Set("Action", "DeleteServiceAccount")
+	values.Set("ServiceAccountId", req.Id)
+	_, err := s3a.executeAction(ctx, values)
+	if err != nil {
+		return nil, err
+	}
+	return &iam_pb.DeleteServiceAccountResponse{}, nil
+}
+
+func (s3a *S3ApiServer) GetServiceAccount(ctx context.Context, req *iam_pb.GetServiceAccountRequest) (*iam_pb.GetServiceAccountResponse, error) {
+	if req == nil {
+		return nil, status.Errorf(codes.InvalidArgument, "request is nil")
+	}
+	if req.Id == "" {
+		return nil, fmt.Errorf("service account id is required")
+	}
+	values := url.Values{}
+	values.Set("Action", "GetServiceAccount")
+	values.Set("ServiceAccountId", req.Id)
+	resp, err := s3a.executeAction(ctx, values)
+	if err != nil {
+		return nil, err
+	}
+	iamResp, ok := resp.(iamGetServiceAccountResponse)
+	if !ok {
+		return nil, fmt.Errorf("unexpected IAM GetServiceAccount response type %T", resp)
+	}
+
+	return &iam_pb.GetServiceAccountResponse{
+		ServiceAccount: &iam_pb.ServiceAccount{
+			Id:          iamResp.GetServiceAccountResult.ServiceAccount.ServiceAccountId,
+			ParentUser:  iamResp.GetServiceAccountResult.ServiceAccount.ParentUser,
+			Description: iamResp.GetServiceAccountResult.ServiceAccount.Description,
+			Credential: &iam_pb.Credential{
+				AccessKey: iamResp.GetServiceAccountResult.ServiceAccount.AccessKeyId,
+				Status:    iamResp.GetServiceAccountResult.ServiceAccount.Status,
+			},
+		},
+	}, nil
+}