Hi, Can you try with the following ARN: arn:aws:iam:::user/oidc$7f71c7c5-c24f-418e-87ac-aa8fe271289b The format of the user id is: <tenant>$<user-namespace>$<sub> , and in $oidc$7f71c7c5-c24f-418e-87ac-aa8fe271289b, the '$' before oidc is a separator for a tenant which is empty here, and ARN for a user is of the format: arn:aws:iam::<tenant>:user/<user-id>, and hence the ARN here will be arn:aws:iam:::user/oidc$7f71c7c5-c24f-418e-87ac-aa8fe271289b Thanks, Pritha On Wed, May 12, 2021 at 4:02 PM Daniel Iwan <iwan.daniel@gmail.com> wrote:
Hi all
I'm working on the following scenario User is authenticated with OIDC and tries to access a bucket which it does not own. How to specify user ID etc. to give access to such a user?
By trial and error I found out that principal can be specified as "Principal": {"Federated":["arn:aws:sts:::assumed-role/MySession"]},
but I want to use shadow user ID or something similar as the principal
Docs https://docs.ceph.com/en/latest/radosgw/STS/ states: 'A shadow user is created corresponding to every federated user. The user id is derived from the ‘sub’ field of the incoming web token. The user is created in a separate namespace - ‘oidc’ such that the user id doesn’t clash with any other user ids in rgw. The format of the user id is - <tenant>$<user-namespace>$<sub> where user-namespace is ‘oidc’ for users that authenticate with oidc providers.'
I see a shadow user in Web UI as e.g. 7f71c7c5-c24f-418e-87ac-aa8fe271289b but I cannot work out the syntax of a user id, I was expecting something like
"arn:aws:iam:::user/$oidc$7f71c7c5-c24f-418e-87ac-aa8fe271289b"
but when trying to list content of a bucket I get AccessDenied. If bucket policy has Principal "*" the my authenticated user can access the bucket
Is this possible? Regards Daniel _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io