PowerScale OneFS 9.8.0.0 Web Administration Guide

Authentication

S3 uses its own method of authentication which relies on access keys that are generated for the user.

The access ID is sent in the HTTP request and is used to identify the user. The secret key is used in the signing algorithm.

There are two signing algorithms, Version 2 (v2) and Version 4 (v4).

S3 requests can either be signed or unsigned. A signed request contains an access ID and a signature. The access ID indicates who the user is. The included signature value is the result of hashing several header values in the request with a secret key. The server must use the access ID to retrieve a copy of the secret key, recompute the expected hash value of the request, and compare against the signature sent. If they match, then the requester is authenticated, and any header value that was used in the signature is now verified to be unchanged as well.

An S3 operation is only performed after the following criteria are met:

• Verify signatures that use AWS Signature Version 4 or AWS Signature Version 2 and validate it against the S3 request.
• Get user credential using access ID, once verification is complete.
• Perform authorization of user credential against bucket ACL.
• Perform traversal check of user credential against object path.
• Perform access check of user credential against object ACL.