Browse Source
S3: Implement IAM defaults and STS signing key fallback (#8348)
S3: Implement IAM defaults and STS signing key fallback (#8348)
* S3: Implement IAM defaults and STS signing key fallback logic * S3: Refactor startup order to init SSE-S3 key manager before IAM * S3: Derive STS signing key from KEK using HKDF for security isolation * S3: Document STS signing key fallback in security.toml * fix(s3api): refine anonymous access logic and secure-by-default behavior - Initialize anonymous identity by default in `NewIdentityAccessManagement` to prevent nil pointer exceptions. - Ensure `ReplaceS3ApiConfiguration` preserves the anonymous identity if not present in the new configuration. - Update `NewIdentityAccessManagement` signature to accept `filerClient`. - In legacy mode (no policy engine), anonymous defaults to Deny (no actions), preserving secure-by-default behavior. - Use specific `LookupAnonymous` method instead of generic map lookup. - Update tests to accommodate signature changes and verify improved anonymous handling. * feat(s3api): make IAM configuration optional - Start S3 API server without a configuration file if `EnableIam` option is set. - Default to `Allow` effect for policy engine when no configuration is provided (Zero-Config mode). - Handle empty configuration path gracefully in `loadIAMManagerFromConfig`. - Add integration test `iam_optional_test.go` to verify empty config behavior. * fix(iamapi): fix signature mismatch in NewIdentityAccessManagementWithStore * fix(iamapi): properly initialize FilerClient instead of passing nil * fix(iamapi): properly initialize filer client for IAM management - Instead of passing `nil`, construct a `wdclient.FilerClient` using the provided `Filers` addresses. - Ensure `NewIdentityAccessManagementWithStore` receives a valid `filerClient` to avoid potential nil pointer dereferences or limited functionality. * clean: remove dead code in s3api_server.go * refactor(s3api): improve IAM initialization, safety and anonymous access security * fix(s3api): ensure IAM config loads from filer after client init * fix(s3): resolve test failures in integration, CORS, and tagging tests - Fix CORS tests by providing explicit anonymous permissions config - Fix S3 integration tests by setting admin credentials in init - Align tagging test credentials in CI with IAM defaults - Added goroutine to retry IAM config load in iamapi server * fix(s3): allow anonymous access to health targets and S3 Tables when identities are present * fix(ci): use /healthz for Caddy health check in awscli tests * iam, s3api: expose DefaultAllow from IAM and Policy Engine This allows checking the global "Open by Default" configuration from other components like S3 Tables. * s3api/s3tables: support DefaultAllow in permission logic and handler Updated CheckPermissionWithContext to respect the DefaultAllow flag in PolicyContext. This enables "Open by Default" behavior for unauthenticated access in zero-config environments. Added a targeted unit test to verify the logic. * s3api/s3tables: propagate DefaultAllow through handlers Propagated the DefaultAllow flag to individual handlers for namespaces, buckets, tables, policies, and tagging. This ensures consistent "Open by Default" behavior across all S3 Tables API endpoints. * s3api: wire up DefaultAllow for S3 Tables API initialization Updated registerS3TablesRoutes to query the global IAM configuration and set the DefaultAllow flag on the S3 Tables API server. This completes the end-to-end propagation required for anonymous access in zero-config environments. Added a SetDefaultAllow method to S3TablesApiServer to facilitate this. * s3api: fix tests by adding DefaultAllow to mock IAM integrations The IAMIntegration interface was updated to include DefaultAllow(), breaking several mock implementations in tests. This commit fixes the build errors by adding the missing method to the mocks. * env * ensure ports * env * env * fix default allow * add one more test using non-anonymous user * debug * add more debug * less logspull/8359/head
Chris Lu
4 weeks ago
committed by
GitHub
GitHub
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
46 changed files with 1083 additions and 108 deletions
-
2.github/workflows/java_integration_tests.yml
-
2.github/workflows/s3-go-tests.yml
-
2.github/workflows/s3-keycloak-tests.yml
-
4.github/workflows/test-s3-over-https-using-awscli.yml
-
11test/s3/cors/Makefile
-
27test/s3/cors/s3_test_config.json
-
7test/s3/normal/iam_test.go
-
8test/s3/normal/s3_integration_test.go
-
8test/s3/policy/policy_test.go
-
4test/s3tables/catalog/iceberg_catalog_test.go
-
68test/s3tables/catalog/pyiceberg_test.go
-
36test/s3tables/catalog/pyiceberg_test_helpers.go
-
1test/s3tables/catalog/test_rest_catalog.py
-
223test/s3tables/catalog/test_rest_catalog_auth.py
-
8test/s3tables/table-buckets/s3tables_integration_test.go
-
18weed/command/mini.go
-
1weed/command/scaffold/security.toml
-
8weed/iam/integration/iam_manager.go
-
8weed/iam/policy/policy_engine.go
-
18weed/iam/sts/sts_service.go
-
23weed/iam/sts/sts_service_test.go
-
11weed/iamapi/iamapi_server.go
-
79weed/s3api/auth_credentials.go
-
6weed/s3api/auth_credentials_test.go
-
2weed/s3api/auth_security_test.go
-
4weed/s3api/auth_signature_v4_sts_test.go
-
6weed/s3api/auth_sts_identity_test.go
-
156weed/s3api/iam_defaults_test.go
-
50weed/s3api/iam_optional_test.go
-
32weed/s3api/iceberg/server.go
-
9weed/s3api/s3_iam_middleware.go
-
52weed/s3api/s3_sse_s3.go
-
6weed/s3api/s3api_put_object_helper_test.go
-
134weed/s3api/s3api_server.go
-
2weed/s3api/s3api_server_routing_test.go
-
23weed/s3api/s3api_tables.go
-
15weed/s3api/s3tables/handler.go
-
4weed/s3api/s3tables/handler_bucket_create.go
-
4weed/s3api/s3tables/handler_bucket_get_list_delete.go
-
4weed/s3api/s3tables/handler_namespace.go
-
9weed/s3api/s3tables/handler_policy.go
-
11weed/s3api/s3tables/handler_table.go
-
10weed/s3api/s3tables/manager.go
-
27weed/s3api/s3tables/permissions.go
-
45weed/s3api/s3tables/permissions_test.go
-
3weed/s3api/sts_params_test.go
@ -0,0 +1,27 @@ |
|||
{ |
|||
"identities": [ |
|||
{ |
|||
"name": "anonymous", |
|||
"actions": [ |
|||
"Read", |
|||
"List" |
|||
] |
|||
}, |
|||
{ |
|||
"name": "admin", |
|||
"credentials": [ |
|||
{ |
|||
"accessKey": "some_access_key1", |
|||
"secretKey": "some_secret_key1" |
|||
} |
|||
], |
|||
"actions": [ |
|||
"Admin", |
|||
"Read", |
|||
"List", |
|||
"Tagging", |
|||
"Write" |
|||
] |
|||
} |
|||
] |
|||
} |
|||
@ -0,0 +1,36 @@ |
|||
package catalog |
|||
|
|||
import ( |
|||
"fmt" |
|||
"io" |
|||
"net/http" |
|||
"testing" |
|||
) |
|||
|
|||
// verifyTableBucketMetadata verifies that a table bucket was created with proper metadata
|
|||
func verifyTableBucketMetadata(t *testing.T, env *TestEnvironment, bucketName string) { |
|||
t.Helper() |
|||
|
|||
// Use S3Tables REST API to get the bucket
|
|||
endpoint := fmt.Sprintf("http://localhost:%d/buckets/%s", env.s3Port, bucketName) |
|||
|
|||
req, err := http.NewRequest(http.MethodGet, endpoint, nil) |
|||
if err != nil { |
|||
t.Fatalf("Failed to create request: %v", err) |
|||
} |
|||
req.Header.Set("Content-Type", "application/x-amz-json-1.1") |
|||
|
|||
resp, err := http.DefaultClient.Do(req) |
|||
if err != nil { |
|||
t.Fatalf("Failed to get table bucket %s: %v", bucketName, err) |
|||
} |
|||
defer resp.Body.Close() |
|||
|
|||
body, _ := io.ReadAll(resp.Body) |
|||
t.Logf("Get table bucket %s response: status=%d, body=%s", bucketName, resp.StatusCode, string(body)) |
|||
|
|||
if resp.StatusCode != http.StatusOK { |
|||
t.Fatalf("Failed to get table bucket %s, status %d: %s", bucketName, resp.StatusCode, body) |
|||
} |
|||
t.Logf("Verified table bucket %s exists with metadata", bucketName) |
|||
} |
|||
@ -0,0 +1,223 @@ |
|||
#!/usr/bin/env python3 |
|||
""" |
|||
Iceberg REST Catalog Compatibility Test for SeaweedFS (Authenticated) |
|||
|
|||
This script tests the Iceberg REST Catalog API compatibility with authentication. |
|||
|
|||
Usage: |
|||
python3 test_rest_catalog_auth.py --catalog-url http://localhost:8182 \\ |
|||
--access-key admin --secret-key admin |
|||
|
|||
Requirements: |
|||
pip install pyiceberg[s3fs] |
|||
""" |
|||
|
|||
import argparse |
|||
import sys |
|||
from pyiceberg.catalog import load_catalog |
|||
from pyiceberg.schema import Schema |
|||
from pyiceberg.types import ( |
|||
IntegerType, |
|||
LongType, |
|||
StringType, |
|||
NestedField, |
|||
) |
|||
from pyiceberg.exceptions import ( |
|||
NamespaceAlreadyExistsError, |
|||
NoSuchNamespaceError, |
|||
TableAlreadyExistsError, |
|||
NoSuchTableError, |
|||
) |
|||
|
|||
|
|||
def test_config_endpoint(catalog): |
|||
"""Test that the catalog config endpoint returns valid configuration.""" |
|||
print("Testing /v1/config endpoint...") |
|||
# The catalog is already loaded which means config endpoint worked |
|||
print(" /v1/config endpoint working") |
|||
return True |
|||
|
|||
|
|||
def test_namespace_operations(catalog, prefix): |
|||
"""Test namespace CRUD operations.""" |
|||
print("Testing namespace operations...") |
|||
namespace = (f"{prefix.replace('-', '_')}_auth_test_ns",) |
|||
|
|||
# List initial namespaces |
|||
namespaces = catalog.list_namespaces() |
|||
print(f" Initial namespaces: {namespaces}") |
|||
|
|||
# Create namespace |
|||
try: |
|||
catalog.create_namespace(namespace) |
|||
print(f" Created namespace: {namespace}") |
|||
except NamespaceAlreadyExistsError: |
|||
print(f" ! Namespace already exists: {namespace}") |
|||
|
|||
# List namespaces (should include our new one) |
|||
namespaces = catalog.list_namespaces() |
|||
if namespace in namespaces: |
|||
print(" Namespace appears in list") |
|||
else: |
|||
print(f" Namespace not found in list: {namespaces}") |
|||
return False |
|||
|
|||
# Get namespace properties |
|||
try: |
|||
props = catalog.load_namespace_properties(namespace) |
|||
print(f" Loaded namespace properties: {props}") |
|||
except NoSuchNamespaceError: |
|||
print(f" Failed to load namespace properties") |
|||
return False |
|||
|
|||
return True |
|||
|
|||
|
|||
def test_table_operations(catalog, prefix): |
|||
"""Test table CRUD operations.""" |
|||
print("Testing table operations...") |
|||
namespace = (f"{prefix.replace('-', '_')}_auth_test_ns",) |
|||
table_name = "auth_test_table" |
|||
table_id = namespace + (table_name,) |
|||
|
|||
# Define a simple schema |
|||
schema = Schema( |
|||
NestedField(field_id=1, name="id", field_type=LongType(), required=True), |
|||
NestedField(field_id=2, name="name", field_type=StringType(), required=False), |
|||
NestedField(field_id=3, name="age", field_type=IntegerType(), required=False), |
|||
) |
|||
|
|||
# Create table |
|||
try: |
|||
table = catalog.create_table( |
|||
identifier=table_id, |
|||
schema=schema, |
|||
) |
|||
print(f" Created table: {table_id}") |
|||
except TableAlreadyExistsError: |
|||
print(f" ! Table already exists: {table_id}") |
|||
_ = catalog.load_table(table_id) |
|||
|
|||
# List tables |
|||
tables = catalog.list_tables(namespace) |
|||
if table_name in [t[1] for t in tables]: |
|||
print(" Table appears in list") |
|||
else: |
|||
print(f" Table not found in list: {tables}") |
|||
return False |
|||
|
|||
# Load table |
|||
try: |
|||
loaded_table = catalog.load_table(table_id) |
|||
print(f" Loaded table: {loaded_table.name()}") |
|||
print(f" Schema: {loaded_table.schema()}") |
|||
print(f" Location: {loaded_table.location()}") |
|||
except NoSuchTableError: |
|||
print(f" Failed to load table") |
|||
return False |
|||
|
|||
return True |
|||
|
|||
|
|||
def test_cleanup(catalog, prefix): |
|||
"""Test table and namespace deletion.""" |
|||
print("Testing cleanup operations...") |
|||
namespace = (f"{prefix.replace('-', '_')}_auth_test_ns",) |
|||
table_id = namespace + ("auth_test_table",) |
|||
|
|||
# Drop table |
|||
try: |
|||
catalog.drop_table(table_id) |
|||
print(f" Dropped table: {table_id}") |
|||
except NoSuchTableError: |
|||
print(f" ! Table already deleted: {table_id}") |
|||
|
|||
# Drop namespace |
|||
try: |
|||
catalog.drop_namespace(namespace) |
|||
print(f" Dropped namespace: {namespace}") |
|||
except NoSuchNamespaceError: |
|||
print(f" ! Namespace already deleted: {namespace}") |
|||
except Exception as e: |
|||
print(f" ? Namespace drop error (may be expected): {e}") |
|||
|
|||
return True |
|||
|
|||
|
|||
def main(): |
|||
parser = argparse.ArgumentParser(description="Test Iceberg REST Catalog with authentication") |
|||
parser.add_argument("--catalog-url", required=True, help="Iceberg REST Catalog URL") |
|||
parser.add_argument("--warehouse", default="s3://iceberg-test/", help="Warehouse location") |
|||
parser.add_argument("--prefix", required=True, help="Table bucket prefix") |
|||
parser.add_argument("--access-key", required=True, help="AWS Access Key ID") |
|||
parser.add_argument("--secret-key", required=True, help="AWS Secret Access Key") |
|||
parser.add_argument("--skip-cleanup", action="store_true", help="Skip cleanup at the end") |
|||
args = parser.parse_args() |
|||
|
|||
print(f"Connecting to Iceberg REST Catalog at: {args.catalog_url}") |
|||
print(f"Warehouse: {args.warehouse}") |
|||
print(f"Prefix: {args.prefix}") |
|||
print(f"Using authenticated access with key: {args.access_key}") |
|||
print() |
|||
|
|||
# Load the REST catalog with authentication |
|||
import time |
|||
max_retries = 10 |
|||
catalog = None |
|||
for attempt in range(max_retries): |
|||
try: |
|||
catalog = load_catalog( |
|||
"rest", |
|||
**{ |
|||
"type": "rest", |
|||
"uri": args.catalog_url, |
|||
"warehouse": args.warehouse, |
|||
"prefix": args.prefix, |
|||
"s3.access-key-id": args.access_key, |
|||
"s3.secret-access-key": args.secret_key, |
|||
} |
|||
) |
|||
print(f"Successfully connected to catalog on attempt {attempt + 1}") |
|||
break |
|||
except Exception as e: |
|||
if attempt < max_retries - 1: |
|||
print(f" Attempt {attempt + 1} failed, retrying in 2s... ({e})") |
|||
time.sleep(2) |
|||
else: |
|||
print(f" All {max_retries} attempts failed.") |
|||
raise e |
|||
|
|||
# Run tests |
|||
tests = [ |
|||
("Config Endpoint", lambda: test_config_endpoint(catalog)), |
|||
("Namespace Operations", lambda: test_namespace_operations(catalog, args.prefix)), |
|||
("Table Operations", lambda: test_table_operations(catalog, args.prefix)), |
|||
] |
|||
|
|||
if not args.skip_cleanup: |
|||
tests.append(("Cleanup", lambda: test_cleanup(catalog, args.prefix))) |
|||
|
|||
passed = 0 |
|||
failed = 0 |
|||
|
|||
for name, test_fn in tests: |
|||
print(f"\n{'='*50}") |
|||
try: |
|||
if test_fn(): |
|||
passed += 1 |
|||
print(f"PASSED: {name}") |
|||
else: |
|||
failed += 1 |
|||
print(f"FAILED: {name}") |
|||
except Exception as e: |
|||
failed += 1 |
|||
print(f"ERROR in {name}: {e}") |
|||
|
|||
print(f"\n{'='*50}") |
|||
print(f"Results: {passed} passed, {failed} failed") |
|||
|
|||
return 0 if failed == 0 else 1 |
|||
|
|||
|
|||
if __name__ == "__main__": |
|||
sys.exit(main()) |
|||
@ -0,0 +1,156 @@ |
|||
package s3api |
|||
|
|||
import ( |
|||
"os" |
|||
"path/filepath" |
|||
"testing" |
|||
|
|||
"github.com/stretchr/testify/assert" |
|||
) |
|||
|
|||
func TestLoadIAMManagerFromConfig_Defaults(t *testing.T) { |
|||
// Create a temporary config file with minimal content (just policy)
|
|||
tmpDir := t.TempDir() |
|||
configPath := filepath.Join(tmpDir, "iam_config.json") |
|||
|
|||
configContent := `{ |
|||
"sts": { |
|||
"providers": [] |
|||
}, |
|||
"policy": { |
|||
"storeType": "memory", |
|||
"defaultEffect": "Allow" |
|||
} |
|||
}` |
|||
|
|||
err := os.WriteFile(configPath, []byte(configContent), 0644) |
|||
assert.NoError(t, err) |
|||
|
|||
// dummy filer address provider
|
|||
filerProvider := func() string { return "localhost:8888" } |
|||
defaultSigningKeyProvider := func() string { return "default-secure-signing-key" } |
|||
|
|||
// Load the manager
|
|||
manager, err := loadIAMManagerFromConfig(configPath, filerProvider, defaultSigningKeyProvider) |
|||
assert.NoError(t, err) |
|||
assert.NotNil(t, manager) |
|||
} |
|||
|
|||
func TestLoadIAMManagerFromConfig_Overrides(t *testing.T) { |
|||
// Create a temporary config file with EXPLICIT values
|
|||
tmpDir := t.TempDir() |
|||
configPath := filepath.Join(tmpDir, "iam_config_explicit.json") |
|||
|
|||
configContent := `{ |
|||
"sts": { |
|||
"tokenDuration": "2h", |
|||
"maxSessionLength": "24h", |
|||
"issuer": "custom-issuer", |
|||
"signingKey": "ZXhwbGljaXQtc2lnbmluZy1rZXktMTIzNDU=" |
|||
}, |
|||
"policy": { |
|||
"storeType": "memory", |
|||
"defaultEffect": "Allow" |
|||
} |
|||
}` |
|||
// Base64 encoded "explicit-signing-key-12345" is "ZXhwbGljaXQtc2lnbmluZy1rZXktMTIzNDU="
|
|||
|
|||
err := os.WriteFile(configPath, []byte(configContent), 0644) |
|||
assert.NoError(t, err) |
|||
|
|||
filerProvider := func() string { return "localhost:8888" } |
|||
defaultSigningKeyProvider := func() string { return "default-secure-signing-key" } |
|||
|
|||
// Load
|
|||
manager, err := loadIAMManagerFromConfig(configPath, filerProvider, defaultSigningKeyProvider) |
|||
assert.NoError(t, err) |
|||
assert.NotNil(t, manager) |
|||
} |
|||
|
|||
func TestLoadIAMManagerFromConfig_PartialDefaults(t *testing.T) { |
|||
// Test that partial configs (e.g. providing SigningKey but not Duration) work
|
|||
tmpDir := t.TempDir() |
|||
configPath := filepath.Join(tmpDir, "iam_config_partial.json") |
|||
|
|||
// Signing key provided in JSON, others missing
|
|||
configContent := `{ |
|||
"sts": { |
|||
"signingKey": "anNvbi1wcm92aWRlZC1rZXktMTIzNDU=" |
|||
}, |
|||
"policy": { |
|||
"storeType": "memory", |
|||
"defaultEffect": "Allow" |
|||
} |
|||
}` |
|||
|
|||
err := os.WriteFile(configPath, []byte(configContent), 0644) |
|||
assert.NoError(t, err) |
|||
|
|||
filerProvider := func() string { return "localhost:8888" } |
|||
// Default signing key provided but should be IGNORED because JSON has one
|
|||
defaultSigningKeyProvider := func() string { return "server-default-key-should-be-ignored" } |
|||
|
|||
manager, err := loadIAMManagerFromConfig(configPath, filerProvider, defaultSigningKeyProvider) |
|||
assert.NoError(t, err) |
|||
assert.NotNil(t, manager) |
|||
} |
|||
|
|||
func TestLoadIAMManagerFromConfig_ExplicitEmptyKey(t *testing.T) { |
|||
// Test that if JSON has empty signing key string, it still falls back
|
|||
tmpDir := t.TempDir() |
|||
configPath := filepath.Join(tmpDir, "iam_config_empty_key.json") |
|||
|
|||
// Signing key explicitly empty
|
|||
configContent := `{ |
|||
"sts": { |
|||
"signingKey": "" |
|||
}, |
|||
"policy": { |
|||
"storeType": "memory", |
|||
"defaultEffect": "Allow" |
|||
} |
|||
}` |
|||
|
|||
err := os.WriteFile(configPath, []byte(configContent), 0644) |
|||
assert.NoError(t, err) |
|||
|
|||
filerProvider := func() string { return "localhost:8888" } |
|||
defaultSigningKeyProvider := func() string { return "fallback-key-should-be-used" } |
|||
|
|||
manager, err := loadIAMManagerFromConfig(configPath, filerProvider, defaultSigningKeyProvider) |
|||
assert.NoError(t, err) |
|||
assert.NotNil(t, manager) |
|||
} |
|||
|
|||
func TestLoadIAMManagerFromConfig_MissingKeyError(t *testing.T) { |
|||
// Test that if BOTH keys are empty, it fails with a clear error
|
|||
tmpDir := t.TempDir() |
|||
configPath := filepath.Join(tmpDir, "iam_config_all_empty.json") |
|||
|
|||
// Signing key explicitly empty in JSON
|
|||
configContent := `{ |
|||
"sts": { |
|||
"signingKey": "" |
|||
}, |
|||
"policy": { |
|||
"storeType": "memory", |
|||
"defaultEffect": "Allow" |
|||
} |
|||
}` |
|||
|
|||
err := os.WriteFile(configPath, []byte(configContent), 0644) |
|||
assert.NoError(t, err) |
|||
|
|||
filerProvider := func() string { return "localhost:8888" } |
|||
defaultSigningKeyProvider := func() string { return "" } // Empty default too
|
|||
|
|||
// Ensure no SSE-S3 key interferes (global state in tests is tricky, but let's assume clean state or no mock)
|
|||
// Ideally we would mock GetSSES3KeyManager().GetMasterKey() but it's a global singleton.
|
|||
// For this unit test, if the global key manager has no key, it should fail.
|
|||
|
|||
_, err = loadIAMManagerFromConfig(configPath, filerProvider, defaultSigningKeyProvider) |
|||
|
|||
// Should return a clear error
|
|||
assert.Error(t, err) |
|||
assert.Contains(t, err.Error(), "no signing key found for STS service") |
|||
} |
|||
@ -0,0 +1,50 @@ |
|||
package s3api |
|||
|
|||
import ( |
|||
"testing" |
|||
|
|||
"github.com/stretchr/testify/assert" |
|||
"github.com/stretchr/testify/require" |
|||
) |
|||
|
|||
func TestLoadIAMManagerFromConfig_OptionalConfig(t *testing.T) { |
|||
// Mock dependencies
|
|||
filerAddressProvider := func() string { return "localhost:8888" } |
|||
getFilerSigningKey := func() string { return "test-signing-key" } |
|||
|
|||
// Test Case 1: Empty config path should load defaults
|
|||
iamManager, err := loadIAMManagerFromConfig("", filerAddressProvider, getFilerSigningKey) |
|||
require.NoError(t, err) |
|||
require.NotNil(t, iamManager) |
|||
|
|||
// Verify STS Service is initialized with defaults
|
|||
stsService := iamManager.GetSTSService() |
|||
assert.NotNil(t, stsService) |
|||
|
|||
// Verify defaults are applied
|
|||
// Since we can't easily access the internal config of stsService,
|
|||
// we rely on the fact that initialization succeeded without error.
|
|||
// We can also verify that the policy engine uses memory store by default.
|
|||
|
|||
// Verify Policy Engine is initialized with defaults (Memory store, Deny effect)
|
|||
// Again, internal state might be hard to access directly, but successful init implies defaults worked.
|
|||
} |
|||
|
|||
func TestLoadIAMManagerFromConfig_EmptyConfigWithFallbackKey(t *testing.T) { |
|||
// Mock dependencies where getFilerSigningKey returns empty, forcing fallback logic
|
|||
// Initialize IAM with empty config (should trigger defaults)
|
|||
// We pass empty string for config file path
|
|||
option := &S3ApiServerOption{ |
|||
Config: "", |
|||
IamConfig: "", |
|||
EnableIam: true, |
|||
} |
|||
iamManager := NewIdentityAccessManagementWithStore(option, nil, "memory") |
|||
|
|||
// Verify identityAnonymous is initialized
|
|||
// This confirms the fix for anonymous access in zero-config mode
|
|||
anonIdentity, found := iamManager.LookupAnonymous() |
|||
assert.True(t, found, "Anonymous identity should be found by default") |
|||
assert.NotNil(t, anonIdentity, "Anonymous identity should not be nil") |
|||
assert.Equal(t, "anonymous", anonIdentity.Name) |
|||
} |
|||
Write
Preview
Loading…
Cancel
Save
Reference in new issue