Bug #61255
opentenanted Bucket not found with presigned POST request
0%
Description
The request is to a bucket created by a user with a tenant.
the request and policy look like this:
curl --location 'https://rgw.example.org/some-bucket' \
--form 'key="test/test1.txt"' \
--form 'X-Amz-Credential="VGYTIETLF6JTF56OCR3F/20251229/default/s3/aws4_request"' \
--form 'X-Amz-Algorithm="AWS4-HMAC-SHA256"' \
--form 'X-Amz-Date="20251229T000000Z"' \
--form 'Policy="eyJleHBpcmF0aW9uIjoiMjAyMy0wNS0xOFQxNDoxOToyMS4wOTZaIiwiY29uZGl0aW9ucyI6W3siYnVja2V0Ijoic29tZS1idWNrZXQifSxbInN0YXJ0cy13aXRoIiwiJGtleSIsInRlc3QvIl0seyJ4LWFtei1jcmVkZW50aWFsIjoiVkdZVElFVExGNkpURjU2T0NSM0YvMjAyNTEyMjkvZGVmYXVsdC9zMy9hd3M0X3JlcXVlc3QifSx7IngtYW16LWFsZ29yaXRobSI6IkFXUzQtSE1BQy1TSEEyNTYifSx7IngtYW16LWRhdGUiOiIyMDI1MTIyOVQwMDAwMDBaIiwieC1hbXotbWV0YS1hdHRhY2htZW50LWlkIjoiMzA0NWU5MTAtMzhhZC00YjIzLWEzYmYtYzFkYzQ5MjA0OGEwIn0se30seyJ4LWFtei1tZXRhLWdvYWwtaWQiOiIxN2YxYjliNS1iODk1LTRjYjItODMwNC05MjE4N2E5M2I5OWUifV19"' \
--form 'X-Amz-Signature="e5407c09b4414e34ad34fcd9cfde2bc568bf1c8d563eb89291675b2da7bdf156"' \
--form 'file=@"test1.txt"'
(the signature doesn't check out in this case because I anonymized some values)
A comparable request (created with the exact some logic) works without issues against AWS S3, but RGW returns 404 "bucket not found".
I tried it both with and without the tenant prefix in the bucket name.
Updated by Phillip Schichtel almost 1 year ago
The request is to a bucket created by a user with a tenant.
The tenant is indeed the issue.
I tried it both with and without the tenant prefix in the bucket name.
It seems my initial test was just wrong. Accessing a bucket without tenant works fine. Accessing a bucket with tenant without prefixing the bucket name fails. Accessing a bucket with tenant with the tenant prefix in the bucket name as "tenant:" works.
I assume it would be possible to use the included X-Amz-Credential field to detect the tenant.
Updated by Phillip Schichtel almost 1 year ago
Alternatively the documentation at https://docs.ceph.com/en/quincy/radosgw/multitenancy/#s3 should include this case.
Updated by Casey Bodley 12 months ago
- Subject changed from Bucket not found with presigned POST request to tenanted Bucket not found with presigned POST request