浏览代码

[raz] Adding MVP of new Client

Romain Rigaux 4 年之前
父节点
当前提交
1b8f196493

+ 237 - 0
desktop/core/src/desktop/lib/raz/ranger/clients/raz_client.py

@@ -0,0 +1,237 @@
+#!/usr/bin/env python
+
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import base64
+import json
+import logging
+import socket
+import sys
+import uuid
+
+import requests
+import requests_kerberos
+
+from datetime import datetime, timedelta
+
+import desktop.lib.raz.ranger.model.signer_protos_pb2 as raz_signer
+
+
+if sys.version_info[0] > 2:
+  from urllib.parse import unquote, urlparse as lib_urlparse
+else:
+  from urllib import unquote
+  from urlparse import urlparse as lib_urlparse
+
+
+LOG = logging.getLogger(__name__)
+
+
+class RazToken(object):
+    def __init__(self, raz_url, kerberos_auth):
+        self.raz_url = raz_url
+        self.kerberos_auth = kerberos_auth
+        self.init_time = datetime.now()
+        self.raz_token = None
+        tstamp=(self.init_time + timedelta(minutes=3)).strftime("%Y%m%dT%H%M%SZ")
+        # ParseResult(scheme='https', netloc='s3-us-west-1.amazonaws.com', path='/', params='', query='X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIA23E77ZX2HVY76YGL%2F20210513%2Fus-west-1%2Fs3%2Faws4_request&X-Amz-Date=20210513T225608Z&X-Amz-Expires=1000&X-Amz-SignedHeaders=host&X-Amz-Signature=edb051e1d6af35fadbf4eeb189f4f8fee342fbeb1af36216cdede253cdddbb74', fragment='')
+        o = urlsplit(self.raz_url)
+        self.raz_port = o.port
+        self.raz_hostname = o.hostname
+        self.scheme = o.scheme
+
+    def get_delegation_token(self, user="csso_ranade"):
+        ip_address = socket.gethostbyname(self.raz_hostname)
+        GET_PARAMS = {"op": "GETDELEGATIONTOKEN", "service": "%s:%s" % (ip_address, self.raz_port), "renewer": user}
+        r = requests.get(self.raz_url, GET_PARAMS, auth=self.kerberos_auth, verify=False)
+        self.raz_token = json.loads(r.text)['Token']['urlString']
+        return self.raz_token
+
+    def renew_delegation_token(self, user="csso_ranade"):
+        if self.raz_token==None:
+            self.raz_token = self.get_delegation_token(user=user)
+        if (self.init_time + timedelta(hours=8)) > datetime.now():
+            r = requests.put("%s?op=RENEWDELEGATIONTOKEN&token=%s"%(self.raz_url, self.raz_token), auth=self.kerberos_auth, verify=False)
+        return self.raz_token
+
+
+class RazToken(object):
+    def __init__(self, raz_url, kerberos_auth):
+        self.raz_url = raz_url
+        self.kerberos_auth = kerberos_auth
+        self.init_time = datetime.now()
+        self.raz_token = None
+        tstamp=(self.init_time + timedelta(minutes=3)).strftime("%Y%m%dT%H%M%SZ")
+        o = urlsplit(self.raz_url)
+        self.raz_port = o.port
+        self.raz_hostname = o.hostname
+        self.scheme = o.scheme
+
+    def get_delegation_token(self, user="csso_ranade"):
+        ip_address = socket.gethostbyname(self.raz_hostname)
+        GET_PARAMS = {"op": "GETDELEGATIONTOKEN", "service": "%s:%s" % (ip_address, self.raz_port), "renewer": user}
+        r = requests.get(self.raz_url, GET_PARAMS, auth=self.kerberos_auth, verify=False)
+        self.raz_token = json.loads(r.text)['Token']['urlString']
+        return self.raz_token
+
+    def renew_delegation_token(self, user="csso_ranade"):
+        if self.raz_token==None:
+            self.raz_token = self.get_delegation_token(user=user)
+        if (self.init_time + timedelta(hours=8)) > datetime.now():
+            r = requests.put("%s?op=RENEWDELEGATIONTOKEN&token=%s"%(self.raz_url, self.raz_token), auth=self.kerberos_auth, verify=False)
+        return self.raz_token
+
+
+class RazClient(object):
+    def __init__(self, request, raz_url, raz_token, *args, **kwargs):
+        LOG.debug("Sign request: {%s}, args: {%s}, kwargs: {%s}"%(request, args, kwargs))
+        self.request = request
+        self.raz_url = raz_url
+        self.raz_token = raz_token
+        self.args = args
+        self.kwargs = kwargs
+        self.requestid = str(uuid.uuid4())
+
+    def check_access(self):
+        LOG.debug("inside sign")
+
+        # parsed_url = lib_urlparse(signed_url)
+
+        o = urlsplit(self.request.url)
+        params = parse_qs(o.query)
+
+        allparams = [raz_signer.StringListStringMapProto(key=key, value=val) for key, val in params.items()]
+        allparams.extend([raz_signer.StringListStringMapProto(key=key, value=val) for key, val in self.request.params.items()])
+        headers = [raz_signer.StringStringMapProto(key=key, value=val) for key, val in self.request.headers.items()]
+        endpoint = "%s://%s" % (o.scheme, o.netloc)
+        resource_path=o.path.lstrip("/")
+
+        LOG.debug(
+          "preparing sign request with http_method: {%s}, header: {%s}, parameters: {%s}, endpoint: {%s}, resource_path: {%s}" %
+          (self.request.method, headers, allparams, endpoint, resource_path)
+        )
+        raz_req = raz_signer.SignRequestProto(
+            endpoint_prefix="s3",
+            service_name="s3",
+            endpoint=endpoint,
+            http_method=self.request.method,
+            headers=headers,
+            parameters=allparams,
+            resource_path=resource_path,
+            time_offset=0
+        )
+        raz_req_serialized = raz_req.SerializeToString()
+        signed_request = base64.b64encode(raz_req_serialized)
+
+        LOG.debug("inside check_access")
+        request_data = {
+          "requestId":self.requestid,
+          "serviceType":"s3",
+          "serviceName":"cm_s3",
+          "user":"csso_ranade",  # make change to improve KERBEROS USER NAME
+          "userGroups":[],
+          "accessTime":"",
+          "clientIpAddress":"",
+          "clientType": "",
+          "clusterName":"prakashdb23",
+          "clusterType":"",
+          "sessionId":"",
+          "context":{"S3_SIGN_REQUEST":signed_request}
+        }
+        headers = {"Content-Type":"application/json", "Accept-Encoding":"gzip,deflate"}
+
+        LOG.debug("sending access check headers: {%s} request_data: {%s}" % (headers, request_data))
+        rurl = "%s/api/authz/s3/access?delegation=%s"%(self.raz_url, self.raz_token)
+        raz_req = requests.post(rurl, headers=headers, json=request_data, verify=False)
+
+        s3_sign_response = None
+        signed_response = None
+
+        if raz_req.ok:
+            if raz_req.json().get("operResult", False) and raz_req.json()["operResult"]["result"]=="NOT_DETERMINED":
+                LOG.error("failure %s"%(raz_req.json()))
+                sys.exit(1)
+            if raz_req.json().get("operResult", False) and raz_req.json()["operResult"]["result"]=="ALLOWED":
+                s3_sign_response=raz_req.json()["operResult"]["additionalInfo"]["S3_SIGN_RESPONSE"]
+            if s3_sign_response:
+                raz_response_proto=raz_signer.SignResponseProto()
+                signed_response=raz_response_proto.FromString(base64.b64decode(s3_sign_response))
+                LOG.debug("Received signed Response %s" % signed_response)
+            if signed_response:
+                for i in signed_response.signer_generated_headers:
+                    self.request.headers[i.key]=i.value
+        if not signed_response:
+            return False
+        return True
+
+
+def getRazSign(request, *args, **kwargs):
+    raz_url="https://prakashdh27-master10.prakashr.xcu2-8y8x.dev.cldr.work:6082"
+    kerberos_auth = requests_kerberos.HTTPKerberosAuth(mutual_authentication=requests_kerberos.OPTIONAL)
+    raz = RazToken(raz_url, kerberos_auth)
+    raz_token = raz.get_delegation_token(user="csso_ranade")
+
+    raz = RazClient(request, raz_url, raz_token, args, kwargs)
+
+    rs = raz.check_access()
+
+    if rs == False:
+        return False
+
+# class RangerRazClient:
+#   def __init__(self, url, auth):
+#     self.url = url
+#     self.session = Session()
+#     self.session.auth = auth
+
+#     logging.getLogger("requests").setLevel(logging.WARNING)
+
+
+# class RangerRazS3:
+#   def __init__(self, url, auth):
+#     self.razClient = RangerRazClient(url, auth)
+
+#   def get_signed_url(self, region, bucket, relative_path, action="read"):
+#     req = RangerRazRequest()
+
+    # endpoint_prefix="s3",
+    # service_name="s3",
+    # endpoint=endpoint, # https://s3-us-west-1.amazonaws.com
+    # http_method=self.request.method,
+    # headers=headers,
+    # parameters=allparams,
+    # resource_path=resource_path,
+    # time_offset=0
+
+    # req.serviceType = "s3"
+    # req.operation = ResourceAccess(
+    #   # TODO: parameters for S3
+    #   {
+    #     "resource": {
+    #       "storageaccount": region,
+    #       "container": bucket,
+    #       "relativepath": relative_path,
+    #     },
+    #     "action": action,
+    #   }
+    # )
+
+    # res = self.razClient.check_privilege(req)
+
+    # # TODO: Check if no access inside RangerRazResult and raise exception, cf. res["operResult"]["result"]=="ALLOWED":
+
+    # return res.operResult.additionalInfo["S3_SIGN_RESPONSE"]

+ 430 - 0
desktop/core/src/desktop/lib/raz/ranger/model/signer_protos_pb2.py

@@ -0,0 +1,430 @@
+# -*- coding: utf-8 -*-
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# source: signer_protos.proto
+"""Generated protocol buffer code."""
+from google.protobuf.internal import enum_type_wrapper
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import message as _message
+from google.protobuf import reflection as _reflection
+from google.protobuf import symbol_database as _symbol_database
+# @@protoc_insertion_point(imports)
+
+_sym_db = _symbol_database.Default()
+
+
+
+
+DESCRIPTOR = _descriptor.FileDescriptor(
+  name='signer_protos.proto',
+  package='com.cloudera.cloud.storage.signer',
+  syntax='proto2',
+  serialized_options=b'\n(com.cloudera.cloud.storage.signer.protosB\024SignerProtocolProtos\210\001\001\240\001\001',
+  create_key=_descriptor._internal_create_key,
+  serialized_pb=b'\n\x13signer_protos.proto\x12!com.cloudera.cloud.storage.signer\"2\n\x14StringStringMapProto\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t\"6\n\x18StringListStringMapProto\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x03(\t\"\x9f\x01\n\x1a\x41uthorizationResponseProto\x12K\n\rresponse_code\x18\x01 \x01(\x0e\x32\x34.com.cloudera.cloud.storage.signer.ResponseCodeProto\x12\x1a\n\x12unauthorized_paths\x18\x02 \x03(\t\x12\x18\n\x10response_message\x18\x03 \x01(\t\"\xfc\x02\n\x10SignRequestProto\x12\x10\n\x08\x65ndpoint\x18\x01 \x01(\t\x12G\n\x0bhttp_method\x18\x02 \x01(\x0e\x32\x32.com.cloudera.cloud.storage.signer.HttpMethodProto\x12H\n\x07headers\x18\x03 \x03(\x0b\x32\x37.com.cloudera.cloud.storage.signer.StringStringMapProto\x12O\n\nparameters\x18\x04 \x03(\x0b\x32;.com.cloudera.cloud.storage.signer.StringListStringMapProto\x12\x17\n\x0f\x63ontent_to_sign\x18\x05 \x01(\x0c\x12\x15\n\rresource_path\x18\x06 \x01(\t\x12\x13\n\x0btime_offset\x18\x07 \x01(\x05\x12\x17\n\x0f\x65ndpoint_prefix\x18\x08 \x01(\t\x12\x14\n\x0cservice_name\x18\t \x01(\t\"\xdd\x01\n\x11SignResponseProto\x12]\n\x16\x61uthorization_response\x18\x01 \x01(\x0b\x32=.com.cloudera.cloud.storage.signer.AuthorizationResponseProto\x12Y\n\x18signer_generated_headers\x18\x02 \x03(\x0b\x32\x37.com.cloudera.cloud.storage.signer.StringStringMapProto\x12\x0e\n\x06region\x18\x03 \x01(\t*P\n\x0fHttpMethodProto\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x00\x12\x07\n\x03GET\x10\x01\x12\x08\n\x04POST\x10\x02\x12\x07\n\x03PUT\x10\x03\x12\n\n\x06\x44\x45LETE\x10\x04\x12\x08\n\x04HEAD\x10\x05*_\n\x11ResponseCodeProto\x12\x14\n\x10\x41UTHZ_AUTHORIZED\x10\x00\x12\x16\n\x12\x41UTHZ_UNAUTHORIZED\x10\x01\x12\x11\n\rAUTHZ_UNKNOWN\x10\x02\x12\t\n\x05\x45RROR\x10\x03\x42\x46\n(com.cloudera.cloud.storage.signer.protosB\x14SignerProtocolProtos\x88\x01\x01\xa0\x01\x01'
+)
+
+_HTTPMETHODPROTO = _descriptor.EnumDescriptor(
+  name='HttpMethodProto',
+  full_name='com.cloudera.cloud.storage.signer.HttpMethodProto',
+  filename=None,
+  file=DESCRIPTOR,
+  create_key=_descriptor._internal_create_key,
+  values=[
+    _descriptor.EnumValueDescriptor(
+      name='DEFAULT', index=0, number=0,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='GET', index=1, number=1,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='POST', index=2, number=2,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='PUT', index=3, number=3,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='DELETE', index=4, number=4,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='HEAD', index=5, number=5,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+  ],
+  containing_type=None,
+  serialized_options=None,
+  serialized_start=935,
+  serialized_end=1015,
+)
+_sym_db.RegisterEnumDescriptor(_HTTPMETHODPROTO)
+
+HttpMethodProto = enum_type_wrapper.EnumTypeWrapper(_HTTPMETHODPROTO)
+_RESPONSECODEPROTO = _descriptor.EnumDescriptor(
+  name='ResponseCodeProto',
+  full_name='com.cloudera.cloud.storage.signer.ResponseCodeProto',
+  filename=None,
+  file=DESCRIPTOR,
+  create_key=_descriptor._internal_create_key,
+  values=[
+    _descriptor.EnumValueDescriptor(
+      name='AUTHZ_AUTHORIZED', index=0, number=0,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='AUTHZ_UNAUTHORIZED', index=1, number=1,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='AUTHZ_UNKNOWN', index=2, number=2,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='ERROR', index=3, number=3,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+  ],
+  containing_type=None,
+  serialized_options=None,
+  serialized_start=1017,
+  serialized_end=1112,
+)
+_sym_db.RegisterEnumDescriptor(_RESPONSECODEPROTO)
+
+ResponseCodeProto = enum_type_wrapper.EnumTypeWrapper(_RESPONSECODEPROTO)
+DEFAULT = 0
+GET = 1
+POST = 2
+PUT = 3
+DELETE = 4
+HEAD = 5
+AUTHZ_AUTHORIZED = 0
+AUTHZ_UNAUTHORIZED = 1
+AUTHZ_UNKNOWN = 2
+ERROR = 3
+
+
+
+_STRINGSTRINGMAPPROTO = _descriptor.Descriptor(
+  name='StringStringMapProto',
+  full_name='com.cloudera.cloud.storage.signer.StringStringMapProto',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  create_key=_descriptor._internal_create_key,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='key', full_name='com.cloudera.cloud.storage.signer.StringStringMapProto.key', index=0,
+      number=1, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='value', full_name='com.cloudera.cloud.storage.signer.StringStringMapProto.value', index=1,
+      number=2, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto2',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=58,
+  serialized_end=108,
+)
+
+
+_STRINGLISTSTRINGMAPPROTO = _descriptor.Descriptor(
+  name='StringListStringMapProto',
+  full_name='com.cloudera.cloud.storage.signer.StringListStringMapProto',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  create_key=_descriptor._internal_create_key,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='key', full_name='com.cloudera.cloud.storage.signer.StringListStringMapProto.key', index=0,
+      number=1, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='value', full_name='com.cloudera.cloud.storage.signer.StringListStringMapProto.value', index=1,
+      number=2, type=9, cpp_type=9, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto2',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=110,
+  serialized_end=164,
+)
+
+
+_AUTHORIZATIONRESPONSEPROTO = _descriptor.Descriptor(
+  name='AuthorizationResponseProto',
+  full_name='com.cloudera.cloud.storage.signer.AuthorizationResponseProto',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  create_key=_descriptor._internal_create_key,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='response_code', full_name='com.cloudera.cloud.storage.signer.AuthorizationResponseProto.response_code', index=0,
+      number=1, type=14, cpp_type=8, label=1,
+      has_default_value=False, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='unauthorized_paths', full_name='com.cloudera.cloud.storage.signer.AuthorizationResponseProto.unauthorized_paths', index=1,
+      number=2, type=9, cpp_type=9, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='response_message', full_name='com.cloudera.cloud.storage.signer.AuthorizationResponseProto.response_message', index=2,
+      number=3, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto2',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=167,
+  serialized_end=326,
+)
+
+
+_SIGNREQUESTPROTO = _descriptor.Descriptor(
+  name='SignRequestProto',
+  full_name='com.cloudera.cloud.storage.signer.SignRequestProto',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  create_key=_descriptor._internal_create_key,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='endpoint', full_name='com.cloudera.cloud.storage.signer.SignRequestProto.endpoint', index=0,
+      number=1, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='http_method', full_name='com.cloudera.cloud.storage.signer.SignRequestProto.http_method', index=1,
+      number=2, type=14, cpp_type=8, label=1,
+      has_default_value=False, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='headers', full_name='com.cloudera.cloud.storage.signer.SignRequestProto.headers', index=2,
+      number=3, type=11, cpp_type=10, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='parameters', full_name='com.cloudera.cloud.storage.signer.SignRequestProto.parameters', index=3,
+      number=4, type=11, cpp_type=10, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='content_to_sign', full_name='com.cloudera.cloud.storage.signer.SignRequestProto.content_to_sign', index=4,
+      number=5, type=12, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"",
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='resource_path', full_name='com.cloudera.cloud.storage.signer.SignRequestProto.resource_path', index=5,
+      number=6, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='time_offset', full_name='com.cloudera.cloud.storage.signer.SignRequestProto.time_offset', index=6,
+      number=7, type=5, cpp_type=1, label=1,
+      has_default_value=False, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='endpoint_prefix', full_name='com.cloudera.cloud.storage.signer.SignRequestProto.endpoint_prefix', index=7,
+      number=8, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='service_name', full_name='com.cloudera.cloud.storage.signer.SignRequestProto.service_name', index=8,
+      number=9, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto2',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=329,
+  serialized_end=709,
+)
+
+
+_SIGNRESPONSEPROTO = _descriptor.Descriptor(
+  name='SignResponseProto',
+  full_name='com.cloudera.cloud.storage.signer.SignResponseProto',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  create_key=_descriptor._internal_create_key,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='authorization_response', full_name='com.cloudera.cloud.storage.signer.SignResponseProto.authorization_response', index=0,
+      number=1, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='signer_generated_headers', full_name='com.cloudera.cloud.storage.signer.SignResponseProto.signer_generated_headers', index=1,
+      number=2, type=11, cpp_type=10, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='region', full_name='com.cloudera.cloud.storage.signer.SignResponseProto.region', index=2,
+      number=3, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto2',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=712,
+  serialized_end=933,
+)
+
+_AUTHORIZATIONRESPONSEPROTO.fields_by_name['response_code'].enum_type = _RESPONSECODEPROTO
+_SIGNREQUESTPROTO.fields_by_name['http_method'].enum_type = _HTTPMETHODPROTO
+_SIGNREQUESTPROTO.fields_by_name['headers'].message_type = _STRINGSTRINGMAPPROTO
+_SIGNREQUESTPROTO.fields_by_name['parameters'].message_type = _STRINGLISTSTRINGMAPPROTO
+_SIGNRESPONSEPROTO.fields_by_name['authorization_response'].message_type = _AUTHORIZATIONRESPONSEPROTO
+_SIGNRESPONSEPROTO.fields_by_name['signer_generated_headers'].message_type = _STRINGSTRINGMAPPROTO
+DESCRIPTOR.message_types_by_name['StringStringMapProto'] = _STRINGSTRINGMAPPROTO
+DESCRIPTOR.message_types_by_name['StringListStringMapProto'] = _STRINGLISTSTRINGMAPPROTO
+DESCRIPTOR.message_types_by_name['AuthorizationResponseProto'] = _AUTHORIZATIONRESPONSEPROTO
+DESCRIPTOR.message_types_by_name['SignRequestProto'] = _SIGNREQUESTPROTO
+DESCRIPTOR.message_types_by_name['SignResponseProto'] = _SIGNRESPONSEPROTO
+DESCRIPTOR.enum_types_by_name['HttpMethodProto'] = _HTTPMETHODPROTO
+DESCRIPTOR.enum_types_by_name['ResponseCodeProto'] = _RESPONSECODEPROTO
+_sym_db.RegisterFileDescriptor(DESCRIPTOR)
+
+StringStringMapProto = _reflection.GeneratedProtocolMessageType('StringStringMapProto', (_message.Message,), {
+  'DESCRIPTOR' : _STRINGSTRINGMAPPROTO,
+  '__module__' : 'signer_protos_pb2'
+  # @@protoc_insertion_point(class_scope:com.cloudera.cloud.storage.signer.StringStringMapProto)
+  })
+_sym_db.RegisterMessage(StringStringMapProto)
+
+StringListStringMapProto = _reflection.GeneratedProtocolMessageType('StringListStringMapProto', (_message.Message,), {
+  'DESCRIPTOR' : _STRINGLISTSTRINGMAPPROTO,
+  '__module__' : 'signer_protos_pb2'
+  # @@protoc_insertion_point(class_scope:com.cloudera.cloud.storage.signer.StringListStringMapProto)
+  })
+_sym_db.RegisterMessage(StringListStringMapProto)
+
+AuthorizationResponseProto = _reflection.GeneratedProtocolMessageType('AuthorizationResponseProto', (_message.Message,), {
+  'DESCRIPTOR' : _AUTHORIZATIONRESPONSEPROTO,
+  '__module__' : 'signer_protos_pb2'
+  # @@protoc_insertion_point(class_scope:com.cloudera.cloud.storage.signer.AuthorizationResponseProto)
+  })
+_sym_db.RegisterMessage(AuthorizationResponseProto)
+
+SignRequestProto = _reflection.GeneratedProtocolMessageType('SignRequestProto', (_message.Message,), {
+  'DESCRIPTOR' : _SIGNREQUESTPROTO,
+  '__module__' : 'signer_protos_pb2'
+  # @@protoc_insertion_point(class_scope:com.cloudera.cloud.storage.signer.SignRequestProto)
+  })
+_sym_db.RegisterMessage(SignRequestProto)
+
+SignResponseProto = _reflection.GeneratedProtocolMessageType('SignResponseProto', (_message.Message,), {
+  'DESCRIPTOR' : _SIGNRESPONSEPROTO,
+  '__module__' : 'signer_protos_pb2'
+  # @@protoc_insertion_point(class_scope:com.cloudera.cloud.storage.signer.SignResponseProto)
+  })
+_sym_db.RegisterMessage(SignResponseProto)
+
+
+DESCRIPTOR._options = None
+# @@protoc_insertion_point(module_scope)