Skip to content

Commit af7875f

Browse files
antonio2368antonio2368
authored
Merge pull request #91706 from ClickHouse/no-s3providers-if-oauth
Don't add S3 providers if GCP OAuth is used
2 parents cc489dc + a0fe0bf commit af7875f

File tree

4 files changed

+43
-23
lines changed

4 files changed

+43
-23
lines changed

‎src/Databases/DataLake/GlueCatalog.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -170,8 +170,8 @@ GlueCatalog::GlueCatalog(
170170
else
171171
{
172172
LOG_TRACE(log, "Creating AWS glue client with credentials empty {}, region '{}', endpoint '{}'", credentials.IsEmpty(), region, endpoint);
173-
std::shared_ptr<DB::S3::S3CredentialsProviderChain> chain = std::make_shared<DB::S3::S3CredentialsProviderChain>(poco_config, credentials, creds_config);
174-
glue_client = std::make_unique<Aws::Glue::GlueClient>(chain, endpoint_provider, client_configuration);
173+
auto credentials_provider = DB::S3::getCredentialsProvider(poco_config, credentials, creds_config);
174+
glue_client = std::make_unique<Aws::Glue::GlueClient>(credentials_provider, endpoint_provider, client_configuration);
175175
}
176176

177177
}

‎src/IO/S3/Client.cpp‎

Lines changed: 1 addition & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1213,21 +1213,7 @@ std::unique_ptr<S3::Client> ClientFactory::create( // NOLINT
12131213
credentials_configuration.use_environment_credentials =
12141214
credentials_configuration.use_environment_credentials || (credentials.IsEmpty() && !credentials_configuration.role_arn.empty());
12151215

1216-
std::shared_ptr<Aws::Auth::AWSCredentialsProvider> credentials_provider = std::make_shared<S3CredentialsProviderChain>(
1217-
client_configuration,
1218-
std::move(credentials),
1219-
credentials_configuration);
1220-
1221-
if (!credentials_configuration.role_arn.empty())
1222-
{
1223-
credentials_provider = AwsAuthSTSAssumeRoleCredentialsProvider::create(
1224-
credentials_configuration.role_arn,
1225-
credentials_configuration.role_session_name,
1226-
credentials_configuration.expiration_window_seconds,
1227-
std::move(credentials_provider),
1228-
client_configuration,
1229-
credentials_configuration.sts_endpoint_override);
1230-
}
1216+
auto credentials_provider = getCredentialsProvider(client_configuration, credentials, credentials_configuration);
12311217

12321218
/// Disable per-thread retry loops if global retry coordination is in use.
12331219
if (client_configuration.s3_slow_all_threads_after_retryable_error)

‎src/IO/S3/Credentials.cpp‎

Lines changed: 34 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -587,7 +587,7 @@ std::shared_ptr<Aws::Auth::AWSCredentialsProvider> AwsAuthSTSAssumeRoleWebIdenti
587587
}
588588
}
589589

590-
auto empty_credentials = std::make_shared<Aws::Auth::SimpleAWSCredentialsProvider>(Aws::Auth::AWSCredentials());
590+
auto empty_credentials = std::make_shared<Aws::Auth::AnonymousAWSCredentialsProvider>();
591591
if (token_file.empty())
592592
{
593593
LOG_WARNING(logger, "Token file must be specified to use STS AssumeRole web identity creds provider.");
@@ -844,12 +844,12 @@ Aws::String SSOCredentialsProvider::loadAccessTokenFile(const Aws::String & sso_
844844
S3CredentialsProviderChain::S3CredentialsProviderChain(
845845
const DB::S3::PocoHTTPClientConfiguration & configuration,
846846
const Aws::Auth::AWSCredentials & credentials,
847-
CredentialsConfiguration credentials_configuration)
847+
const CredentialsConfiguration & credentials_configuration)
848848
{
849849
auto logger = getLogger("S3CredentialsProviderChain");
850850

851851
/// we don't provide any credentials to avoid signing
852-
if (credentials_configuration.no_sign_request)
852+
if (credentials_configuration.no_sign_request || configuration.http_client == "gcp_oauth")
853853
return;
854854

855855
/// add explicit credentials to the front of the chain
@@ -1103,7 +1103,7 @@ std::shared_ptr<Aws::Auth::AWSCredentialsProvider> AwsAuthSTSAssumeRoleCredentia
11031103
std::string session_name_,
11041104
uint64_t expiration_window_seconds_,
11051105
std::shared_ptr<Aws::Auth::AWSCredentialsProvider> credentials_provider,
1106-
DB::S3::PocoHTTPClientConfiguration & client_configuration,
1106+
const DB::S3::PocoHTTPClientConfiguration & client_configuration,
11071107
const std::string & sts_endpoint_override)
11081108
{
11091109
auto client = std::make_shared<AWSAssumeRoleClient>(credentials_provider, client_configuration, sts_endpoint_override);
@@ -1165,6 +1165,36 @@ void AwsAuthSTSAssumeRoleCredentialsProvider::Reload()
11651165
LOG_TRACE(logger, "Successfully retrieved credentials");
11661166
}
11671167

1168+
std::shared_ptr<Aws::Auth::AWSCredentialsProvider> getCredentialsProvider(
1169+
const DB::S3::PocoHTTPClientConfiguration & configuration,
1170+
const Aws::Auth::AWSCredentials & credentials,
1171+
const CredentialsConfiguration & credentials_configuration)
1172+
{
1173+
std::shared_ptr<Aws::Auth::AWSCredentialsProvider> credentials_provider;
1174+
if (credentials_configuration.no_sign_request || configuration.http_client == "gcp_oauth")
1175+
{
1176+
credentials_provider = std::make_shared<Aws::Auth::AnonymousAWSCredentialsProvider>();
1177+
}
1178+
else
1179+
{
1180+
credentials_provider
1181+
= std::make_shared<S3CredentialsProviderChain>(configuration, credentials, credentials_configuration);
1182+
}
1183+
1184+
if (!credentials_configuration.role_arn.empty())
1185+
{
1186+
credentials_provider = AwsAuthSTSAssumeRoleCredentialsProvider::create(
1187+
credentials_configuration.role_arn,
1188+
credentials_configuration.role_session_name,
1189+
credentials_configuration.expiration_window_seconds,
1190+
std::move(credentials_provider),
1191+
configuration,
1192+
credentials_configuration.sts_endpoint_override);
1193+
}
1194+
1195+
return credentials_provider;
1196+
}
1197+
11681198
}
11691199

11701200
}

‎src/IO/S3/Credentials.h‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -214,7 +214,7 @@ class S3CredentialsProviderChain : public Aws::Auth::AWSCredentialsProviderChain
214214
S3CredentialsProviderChain(
215215
const DB::S3::PocoHTTPClientConfiguration & configuration,
216216
const Aws::Auth::AWSCredentials & credentials,
217-
CredentialsConfiguration credentials_configuration);
217+
const CredentialsConfiguration & credentials_configuration);
218218
};
219219

220220
class AssumeRoleRequest : public Aws::AmazonSerializableWebServiceRequest
@@ -283,7 +283,7 @@ class AwsAuthSTSAssumeRoleCredentialsProvider : public Aws::Auth::AWSCredentials
283283
std::string session_name_,
284284
uint64_t expiration_window_seconds_,
285285
std::shared_ptr<Aws::Auth::AWSCredentialsProvider> credentials_provider,
286-
DB::S3::PocoHTTPClientConfiguration & client_configuration,
286+
const DB::S3::PocoHTTPClientConfiguration & client_configuration,
287287
const std::string & sts_endpoint_override = "");
288288

289289
AwsAuthSTSAssumeRoleCredentialsProvider(
@@ -317,6 +317,10 @@ class AwsAuthSTSAssumeRoleCredentialsProvider : public Aws::Auth::AWSCredentials
317317
LoggerPtr logger;
318318
};
319319

320+
std::shared_ptr<Aws::Auth::AWSCredentialsProvider> getCredentialsProvider(
321+
const DB::S3::PocoHTTPClientConfiguration & configuration,
322+
const Aws::Auth::AWSCredentials & credentials,
323+
const CredentialsConfiguration & credentials_configuration);
320324
}
321325

322326
#else

0 commit comments

Comments
 (0)