Secure Token Service in Ceph
summary
Ceph RGW implements AWS‑style STS: it issues encrypted temporary credentials (access key, secret, session token) and supports assume role, assume role with web identity (Keycloak tested) and get session token. ABAC works via session tags including multi‑valued tag matching (ForAnyValue/ForAllValue) so policies can be generic. STS Lite reduces Keystone latency by exchanging EC2 creds for short RGW tokens. A custom Java credentials provider adds session duration, session policies and refresh tokens. Role and policy metadata replication across zones exists in multi‑site active‑active (available since Reef).
AI-written summary · about
chapters (12)
- 0:00Introduction to STS
- 1:26Basic building blocks
- 3:58Supported APIs in RGW
- 6:25Assume role with web identity
- 7:29Session policies in STS
- 9:36Permission evaluation in RGW
- 10:41ABAC authorization strategy
- 13:06Multi-valued tag conditions
- 15:16STS Lite for external auth
- 16:42Custom credentials provider
- 18:06Multi-site metadata replication
- 19:10Q&A session
related talks
25mHow to Kill an AWS Access Key
27mEncrypting Data in Ceph: An Overview and Opportunities
31mScale Permissions Management With Attribute-based Access Control
45mManaging hybrid workloads with IAM Roles Anywhere, featuring
34mThrow Away Your Passwords: Trusting Workload Identity
37mIntroducing Ceph Mgmt-gateway: Unified Access, OIDC-based SSO, and HA for Manageme...
35mAuthentication Challenges In Multi-Region Deployments
35mData Security and Storage Hardening in Rook and Ceph