Start up a new machine auth provider in the storage service

[ishank011]

No description provided.

[C0rby]

Why is that bearer now instead of machine but still using the machineAuthAPIKey?

[ishank011]

That's because machine is just a driver for bearer auth. https://github.com/owncloud/ocis/blob/master/storage/pkg/command/authbearer.go#L105-L117

And the auth registry recognizes only the bearer auth type https://github.com/owncloud/ocis/blob/master/storage/pkg/command/gateway.go#L157

I think we can somehow combine the bearer driver flag with the proxy backend one to make sure that we're only using machine in case the backend being used is cs3.

[C0rby]

I see. Don't we need to change the flagset value to machine then? In my current understanding it would break if we don't since the default driver of the bearer provider is oidc.

ocis/storage/pkg/flagset/authbearer.go

Line 25 in b98b39f

Value: flags.OverrideDefaultString(cfg.Reva.AuthBearerConfig.Driver, "oidc"),

[C0rby]

Or maybe start another auth provider along with the existing basic and bearer providers for the machine authentication.

[ishank011]

Yes, both ideas sound good. I wouldn't want to change the default flag value but I can add a check

if PROXY_ACCOUNT_BACKEND_TYPE == "cs3" && STORAGE_AUTH_BEARER_DRIVER != "machine"
    raise error

Or add a separate auth provider. Which one would you prefer?

[C0rby]

In my opinion a separate auth provider would be cleaner.

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
2 Code Smells

12.2% Coverage
20.5% Duplication

[C0rby]

LGTM