ceph/ceph — pull request #492 by roaldvanloon (2013-08-09 13:01:03+00:00)
Title: Validate S3 tokens against Keystone

I came across http://tracker.ceph.com/issues/5506 and realized I've actually created this once.

It's a fairly simple implementation. Added two config settings to enable either one of the two authentication backends (keystone, rados internal), or both. When both are enabled, keystone is tried first with fallback to rados internal (I've used this once to migrate data). When neither is enabled, a warning is issued. It uses the s3token middleware in Keystone (which in turn checks for ec2-credentials).

I admit this isn't a nice solution (there should probably be something like an authentication pipeline which can be used by both swift and s3 apis), but people might find this a nice feature for now.

Note: there is no token caching, yet. Contrary to what is stated in feature #5506, I don't see why this isn't possible though.

Signed-off-by: Roald J. van Loon