registry team mailing list archive

[vishvananda <vishvananda@xxxxxxxxx>]

Actually no.

The last paramater passed to authenticate is False, which tells
authenticate not to check the signature.  The reason for this from the
legacy code is that authenticate was constructed to verify aws
signatures and unfortunately s3 uses a completely different method for
signing requests.  Authenticate returns the proper user and project but
does NOT currently check the signature for objectstore requests.

Authorize may need to reworked a bit because it needs a little more data
for the s3 version, like content-type and md5.  Docs here:

http://docs.amazonwebservices.com/AmazonS3/latest/dev/index.html?RESTAuthentication.html

-- 
Authorization not checked on objectstore
https://bugs.launchpad.net/bugs/607512
You received this bug notification because you are a member of Registry
Administrators, which is subscribed to OpenStack.