On swift configured on devstack, I'm unable to upload object in a container where Write ACL has been set by using the swift client. Performing same operation with curl client works as expected.
Command outputs :
The container where wite ACL has been set. demo user owns the Admin role.
$ swift --os-tenant-name=demo --os-username=demo --os-password=wxcvbn --os-auth-url=http://localhost:5000/v2.0 s
tat container
Account: AUTH_cbd3ac87d06b4f73b096ae2d4bcbb477
Container: container
Objects: 3
Bytes: 10724
Read ACL:
Write ACL: demo:demouser2
Sync To:
Sync Key:
Accept-Ranges: bytes
X-Timestamp: 1374660280.52319
X-Trans-Id: tx12fce7c35acb40b2bcf9f09742ea762d
Content-Type: text/plain; charset=utf-8
The user demouser2 has no roles but it is allowed to PUT object in container 'container'. But two errors are return. This command should work according to the write ACL.
$ swift --os-tenant-name=demo --os-username=demouser2 --os-password=demouser2 --os-auth-url=http://localhost:500
0/v2.0 upload container exercise.sh
Error trying to create container 'container': 403 Forbidden: <html><h1>Forbidden</h1><p>Access was denied to this resourc
Object HEAD failed: http://192.168.56.102:8080/v1/AUTH_cbd3ac87d06b4f73b096ae2d4bcbb477/container/exercise.sh 403 Forbidden
If I configure the write ACL plus the read ACL the object is uploaded but an error is still returned :
$ swift --os-tenant-name=demo --os-username=demo --os-password=wxcvbn --os-auth-url=http://localhost:5000/v2.0 p
ost container -r 'demo:demouser2'
$ swift --os-tenant-name=demo --os-username=demouser2 --os-password=demouser2 --os-auth-url=http://localhost:500
0/v2.0 upload container exercise.sh
Error trying to create container 'container': 403 Forbidden: <html><h1>Forbidden</h1><p>Access was denied to this resourc
exercise.sh
$ swift --os-tenant-name=demo --os-username=demo --os-password=wxcvbn --os-auth-url=http://localhost:5000/v2.0 l
ist container
exercise.sh
If I use curl to perform the same operation:
$ T=$(keystone --os-tenant-name=demo --os-username=demouser2 --os-password=demouser2 --os-auth-url=http://localh
ost:5000/v2.0 token-get | awk '/ id / {print $4}')
$ swift --os-tenant-name=demo --os-username=demo --os-password=wxcvbn --os-auth-url=http://localhost:5000/v2.0 s
tat container
Account: AUTH_cbd3ac87d06b4f73b096ae2d4bcbb477
Container: container
Objects: 3
Bytes: 10724
Read ACL:
Write ACL: demo:demouser2
Sync To:
Sync Key:
Accept-Ranges: bytes
X-Timestamp: 1374660280.52319
X-Trans-Id: tx12fce7c35acb40b2bcf9f09742ea762d
Content-Type: text/plain; charset=utf-8
$ curl -XGET -H "X-Auth-Token: $T" http://localhost:8080/v1/AUTH_cbd3ac87d06b4f73b096ae2d4bcbb477/container/open
rc
<html><h1>Forbidden</h1><p>Access was denied to this resource.</p></html>fabien@devstack-local:~/devstack$
$ curl -i -XPUT -H "X-Auth-Token: $T" --data-binary "bouh" http://localhost:8080/v1/AUTH_cbd3ac87d06b4f73b096ae2
d4bcbb477/container/openrc
HTTP/1.1 201 Created
Last-Modified: Wed, 24 Jul 2013 15:06:22 GMT
Content-Length: 0
Etag: c9c5384adec41a13eea91ed4d20d809e
Content-Type: text/html; charset=UTF-8
X-Trans-Id: tx122f5662075f4c8d8f316021468982bf
Date: Wed, 24 Jul 2013 15:06:22 GMT
Peter, you might want to have a look at Thiago's patch
https:/