Discussion:
[ceph-users] Need help related to authentication
Rishabh S
2018-12-04 17:54:52 UTC
Permalink
Dear Members,

I am new to ceph and implementing object store using ceph.

I have following scenario.

1. I have an application which needs to store thousands of files in to ceph cluster
2. My application will be deployed in kubernetes cluster
3. My application will communicate using Rest API

My application will be ceph client which will be communicating ceph cluster using http/https.
Can some one please help me with how my application should get access-key/secret-key to communicate with ceph cluster.

I am mainly looking for rest/http api example for initial authentication/authorization handshake.

Thanks in advance.

Regards,
Rishabh
Paul Emmerich
2018-12-04 21:18:53 UTC
Permalink
You are probably looking for radosgw-admin which can manage users on
the shell, e.g.:

radosgw-admin user create --uid username --display-name "full name"
radosgw-admin user list
radosgw-admin user info --uid username

The create and info commands return the secret/access key which can be
used with any S3 client.
--
Paul Emmerich

Looking for help with your Ceph cluster? Contact us at https://croit.io

croit GmbH
Freseniusstr. 31h
81247 München
www.croit.io
Tel: +49 89 1896585 90
Post by Rishabh S
Dear Members,
I am new to ceph and implementing object store using ceph.
I have following scenario.
1. I have an application which needs to store thousands of files in to ceph cluster
2. My application will be deployed in kubernetes cluster
3. My application will communicate using Rest API
My application will be ceph client which will be communicating ceph cluster using http/https.
Can some one please help me with how my application should get access-key/secret-key to communicate with ceph cluster.
I am mainly looking for rest/http api example for initial authentication/authorization handshake.
Thanks in advance.
Regards,
Rishabh
_______________________________________________
ceph-users mailing list
http://lists.ceph.com/listinfo.cgi/ceph-users-ceph.com
Rishabh S
2018-12-05 04:41:02 UTC
Permalink
Hi Paul,

Thank You.

I was looking for suggestions on how my ceph client should get access and secret keys.

Another thing where I need help is regarding encryption
http://docs.ceph.com/docs/mimic/radosgw/encryption/# <http://docs.ceph.com/docs/mimic/radosgw/encryption/#>

I am little confused what does these statement means.

The Ceph Object Gateway supports server-side encryption of uploaded objects, with 3 options for the management of encryption keys. Server-side encryption means that the data is sent over HTTP in its unencrypted form, and the Ceph Object Gateway stores that data in the Ceph Storage Cluster in encrypted form.

Note Requests for server-side encryption must be sent over a secure HTTPS connection to avoid sending secrets in plaintext.

CUSTOMER-PROVIDED KEYS <http://docs.ceph.com/docs/mimic/radosgw/encryption/#customer-provided-keys>
In this mode, the client passes an encryption key along with each request to read or write encrypted data. It is the client’s responsibility to manage those keys and remember which key was used to encrypt each object.


My understanding is when ceph client is trying to upload a file/object to Ceph cluster then client request should be https and will include “customer-provided-key”.
Then Ceph will use customer-provided-key to encrypt file/object before storing data into Ceph cluster.

Please correct and suggest best approach to store files/object in Ceph cluster.

Any code example of initial handshake to upload a file/object with encryption-key will be of great help.

Regards,
Rishabh
Post by Paul Emmerich
You are probably looking for radosgw-admin which can manage users on
radosgw-admin user create --uid username --display-name "full name"
radosgw-admin user list
radosgw-admin user info --uid username
The create and info commands return the secret/access key which can be
used with any S3 client.
--
Paul Emmerich
Looking for help with your Ceph cluster? Contact us at https://croit.io
croit GmbH
Freseniusstr. 31h
81247 MÃŒnchen
www.croit.io
Tel: +49 89 1896585 90
Post by Rishabh S
Dear Members,
I am new to ceph and implementing object store using ceph.
I have following scenario.
1. I have an application which needs to store thousands of files in to ceph cluster
2. My application will be deployed in kubernetes cluster
3. My application will communicate using Rest API
My application will be ceph client which will be communicating ceph cluster using http/https.
Can some one please help me with how my application should get access-key/secret-key to communicate with ceph cluster.
I am mainly looking for rest/http api example for initial authentication/authorization handshake.
Thanks in advance.
Regards,
Rishabh
_______________________________________________
ceph-users mailing list
http://lists.ceph.com/listinfo.cgi/ceph-users-ceph.com
Benjeman Meekhof
2018-12-05 14:20:50 UTC
Permalink
Hi Rishabh,

You might want to check out these examples for python boto3 which include SSE-C:
https://github.com/boto/boto3/blob/develop/boto3/examples/s3.rst

As already noted use 'radosgw-admin' to retrieve access key and secret
key to plug into your client. If you are not an administrator on your
Ceph cluster you may have to ask someone who is to create/retrieve the
necessary user info. Example:

radosgw-admin user info --uid testuser
.....
"keys": [
{
"user": "testuser",
"access_key":"ABCDE0",
"secret_key": "1FGHIJK"
}

There is also an Admin API to retrieve this information but you
wouldn't use it unless your application is something more general
purpose requiring access to all user credentials (or other
information). There are libraries for this API as well noted at the
bottom of the docs page. If you just need an access/secret to plug
into your client this is not what you are looking for - to even use it
you still need to create a user with the radosgw-admin command. If
you need to programmatically manage / retrieve user info with some
kind of privileged application it might be of use.
http://docs.ceph.com/docs/mimic/radosgw/adminops/

thanks,
Ben
Post by Rishabh S
Hi Paul,
Thank You.
I was looking for suggestions on how my ceph client should get access and secret keys.
Another thing where I need help is regarding encryption
http://docs.ceph.com/docs/mimic/radosgw/encryption/#
I am little confused what does these statement means.
The Ceph Object Gateway supports server-side encryption of uploaded objects, with 3 options for the management of encryption keys. Server-side encryption means that the data is sent over HTTP in its unencrypted form, and the Ceph Object Gateway stores that data in the Ceph Storage Cluster in encrypted form.
Note Requests for server-side encryption must be sent over a secure HTTPS connection to avoid sending secrets in plaintext.
CUSTOMER-PROVIDED KEYS
In this mode, the client passes an encryption key along with each request to read or write encrypted data. It is the client’s responsibility to manage those keys and remember which key was used to encrypt each object.
My understanding is when ceph client is trying to upload a file/object to Ceph cluster then client request should be https and will include “customer-provided-key”.
Then Ceph will use customer-provided-key to encrypt file/object before storing data into Ceph cluster.
Please correct and suggest best approach to store files/object in Ceph cluster.
Any code example of initial handshake to upload a file/object with encryption-key will be of great help.
Regards,
Rishabh
You are probably looking for radosgw-admin which can manage users on
radosgw-admin user create --uid username --display-name "full name"
radosgw-admin user list
radosgw-admin user info --uid username
The create and info commands return the secret/access key which can be
used with any S3 client.
--
Paul Emmerich
Looking for help with your Ceph cluster? Contact us at https://croit.io
croit GmbH
Freseniusstr. 31h
81247 München
www.croit.io
Tel: +49 89 1896585 90
Dear Members,
I am new to ceph and implementing object store using ceph.
I have following scenario.
1. I have an application which needs to store thousands of files in to ceph cluster
2. My application will be deployed in kubernetes cluster
3. My application will communicate using Rest API
My application will be ceph client which will be communicating ceph cluster using http/https.
Can some one please help me with how my application should get access-key/secret-key to communicate with ceph cluster.
I am mainly looking for rest/http api example for initial authentication/authorization handshake.
Thanks in advance.
Regards,
Rishabh
_______________________________________________
ceph-users mailing list
http://lists.ceph.com/listinfo.cgi/ceph-users-ceph.com
_______________________________________________
ceph-users mailing list
http://lists.ceph.com/listinfo.cgi/ceph-users-ceph.com
Rishabh S
2018-12-06 03:41:43 UTC
Permalink
Hi Benjeman.

Thank You for much needed help.

Best Regards,
Rishabh
Post by Benjeman Meekhof
Hi Rishabh,
https://github.com/boto/boto3/blob/develop/boto3/examples/s3.rst
As already noted use 'radosgw-admin' to retrieve access key and secret
key to plug into your client. If you are not an administrator on your
Ceph cluster you may have to ask someone who is to create/retrieve the
radosgw-admin user info --uid testuser
.....
"keys": [
{
"user": "testuser",
"access_key":"ABCDE0",
"secret_key": "1FGHIJK"
}
There is also an Admin API to retrieve this information but you
wouldn't use it unless your application is something more general
purpose requiring access to all user credentials (or other
information). There are libraries for this API as well noted at the
bottom of the docs page. If you just need an access/secret to plug
into your client this is not what you are looking for - to even use it
you still need to create a user with the radosgw-admin command. If
you need to programmatically manage / retrieve user info with some
kind of privileged application it might be of use.
http://docs.ceph.com/docs/mimic/radosgw/adminops/
thanks,
Ben
Post by Rishabh S
Hi Paul,
Thank You.
I was looking for suggestions on how my ceph client should get access and secret keys.
Another thing where I need help is regarding encryption
http://docs.ceph.com/docs/mimic/radosgw/encryption/#
I am little confused what does these statement means.
The Ceph Object Gateway supports server-side encryption of uploaded objects, with 3 options for the management of encryption keys. Server-side encryption means that the data is sent over HTTP in its unencrypted form, and the Ceph Object Gateway stores that data in the Ceph Storage Cluster in encrypted form.
Note Requests for server-side encryption must be sent over a secure HTTPS connection to avoid sending secrets in plaintext.
CUSTOMER-PROVIDED KEYS
In this mode, the client passes an encryption key along with each request to read or write encrypted data. It is the client’s responsibility to manage those keys and remember which key was used to encrypt each object.
My understanding is when ceph client is trying to upload a file/object to Ceph cluster then client request should be https and will include “customer-provided-key”.
Then Ceph will use customer-provided-key to encrypt file/object before storing data into Ceph cluster.
Please correct and suggest best approach to store files/object in Ceph cluster.
Any code example of initial handshake to upload a file/object with encryption-key will be of great help.
Regards,
Rishabh
You are probably looking for radosgw-admin which can manage users on
radosgw-admin user create --uid username --display-name "full name"
radosgw-admin user list
radosgw-admin user info --uid username
The create and info commands return the secret/access key which can be
used with any S3 client.
--
Paul Emmerich
Looking for help with your Ceph cluster? Contact us at https://croit.io
croit GmbH
Freseniusstr. 31h
81247 München
www.croit.io
Tel: +49 89 1896585 90
Dear Members,
I am new to ceph and implementing object store using ceph.
I have following scenario.
1. I have an application which needs to store thousands of files in to ceph cluster
2. My application will be deployed in kubernetes cluster
3. My application will communicate using Rest API
My application will be ceph client which will be communicating ceph cluster using http/https.
Can some one please help me with how my application should get access-key/secret-key to communicate with ceph cluster.
I am mainly looking for rest/http api example for initial authentication/authorization handshake.
Thanks in advance.
Regards,
Rishabh
_______________________________________________
ceph-users mailing list
http://lists.ceph.com/listinfo.cgi/ceph-users-ceph.com
_______________________________________________
ceph-users mailing list
http://lists.ceph.com/listinfo.cgi/ceph-users-ceph.com
Loading...