Dell DX6000 Administration Manual

Also see for DX6000: Manual Supplementary guide Hardware installation instructions Hardware owner's manual Application guide

Contents

Copyright © 2010 Caringo, Inc.All rights reserved 22Version 5.0December 20104.7.1.3. Using Override to Resolve Authorization Specification IssuesThis section discusses how to resolve issues with authorization specifications that render objectsinaccessible. You can perform these tasks to reset the authorization specification for any object,even an object for which an authorized user name and password are not known.To resolve this issue, you must PUT to the object the user list and the authorization specificationusing the admin query argument, authenticating with your cluster administrator credentials.ImportantDo not use this procedure if the current Castor-Authorization header uses owner@or @owner syntax because the CAStor administrator realm becomes the ownerof the object and, as a result, no other realm can change the authorization specificationlater.A sample procedure follows.1. Create the user list.A user list (also referred to as a security realm or realm) is a collection of user credentials, eachof which includes an MD5 hash using the HTTP Digest authentication algorithm.You compute user list or realm from the string username:realm:password.ImportantThe realm name must exactly match the name of the domain or bucket.For example to create a user list for a domain, htdigest cluster_example_comcluster.example.com sample.usernameTo create a user list for mybucket in the same domain, htdigestcluster_example_com_mybucket cluster.example.com/mybucketsample.username2. HEAD the current value of the Castor-Authorization header for the object.curl --anyauth -u "your-username:your-password" --location-trusted"http://node-ip[/bucket-name]?admin[&domain=name]" [-D log-file-name]You must specify domain=name in a HEAD for a domain. If the HEAD is for a bucket, the domainname is required as the Host in the request if the domain is not the default cluster domain.ImportantIf the Castor-Authorization header includes @owner or owner@, stop.GET the user list for the object and confirm whether or not any realm has post orchange privileges to the object. (For example, if the Castor-Authorizationheader includes change=@owner, any user in the object owner's realm can modify theobject.) Ask one of those users to modify the Castor-Authorization header.If no user can modify a Castor-Authorization header that includes @owner orowner@, you can either take ownership of the object permanently by continuing with