[PR #1927] [MERGED] Enabled to load shared library for Credential and Token #2261

New issue

Closed

opened 2026-03-04 02:04:37 +03:00 by kerem · 0 comments

kerem commented

2026-03-04 02:04:37 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/s3fs-fuse/s3fs-fuse/pull/1927
Author: @ggtakec
Created: 3/18/2022
Status: ✅ Merged
Merged: 10/22/2022
Merged by: @ggtakec

Base: master ← Head: extcred_mod

📝 Commits (1)

5f5e69f Enabled to load shared library for Credential and Token

📊 Changes

8 files changed (+592 additions, -20 deletions)

View changed files

📝 configure.ac (+5 -0)
📝 doc/man/s3fs.1.in (+9 -0)
📝 src/common.h (+5 -0)
📝 src/s3fs.cpp (+29 -8)
📝 src/s3fs_cred.cpp (+361 -11)
📝 src/s3fs_cred.h (+23 -1)
➕ src/s3fs_extcred.h (+144 -0)
📝 src/s3fs_help.cpp (+16 -0)

📄 Description

Relevant Issue (if applicable)

#1068

Details

Overview

Allows an external shared library to be used instead of s3fs' built-in credentials(and tokens) processing.
Shared libraries are expected to implement credential(and token) processing.

This allows user to make implementations other than the built-in credential processing.
For example, you can replace the built-in processing by providing the credential processing provided by s3fs-sdk-cpp as a shared library.
And it is also possible to support servers that perform credential processing that is not compatible with AWS S3.
(For example, IBM's credential processing for storage could be a shared library.)

Details

Add two options to s3fs, credlib and credlib_ops. Each definition is shown below:

credlib
Specify the shared library name(or path) for this option.
The specified shared library will be loaded at s3fs startup and unloaded at exit.
credlib_ops
This option specifies the option string to be passed when loading(initializing) the shared library specified by credlib.
This option parameter string is decided by the shared library.
Specify an appropriate character string according to the contents.

The built-in passwd_file, profile, use_session_token, ecs, ibm_iam_auth, ibm_iam_endpoint, imdsv1only and iam_role options are not available when using these options.

The shared library needs to export the following functions(There are required and optional):

Required

const char* VersionS3fsCredential(bool detail);
bool UpdateS3fsCredential(char** ppaccess_key_id, char** ppserect_access_key, char** ppaccess_token, long long* ptoken_expire, char** pperrstr);

Optional

bool InitS3fsCredential(const char* popts, char** pperrstr);
bool FreeS3fsCredential(char** pperrstr);

See the s3fs_extcred.h file for the contents of each function.

Reference

This PR is one of the solutions for #1068.

Implementation example

I made the credential processing of aws-sdk-cpp into this shared library.
https://github.com/ggtakec/s3fs-fuse-awscred-lib

I think anyone can use it and try it out.
(We are also considering transferring this library to the s3fs-fuse organization if agreed.)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/s3fs-fuse/s3fs-fuse/pull/1927 **Author:** [@ggtakec](https://github.com/ggtakec) **Created:** 3/18/2022 **Status:** ✅ Merged **Merged:** 10/22/2022 **Merged by:** [@ggtakec](https://github.com/ggtakec) **Base:** `master` ← **Head:** `extcred_mod` --- ### 📝 Commits (1) - [`5f5e69f`](https://github.com/s3fs-fuse/s3fs-fuse/commit/5f5e69f72ff5da1c8e434ca639ee237ac506b605) Enabled to load shared library for Credential and Token ### 📊 Changes **8 files changed** (+592 additions, -20 deletions) <details> <summary>View changed files</summary> 📝 `configure.ac` (+5 -0) 📝 `doc/man/s3fs.1.in` (+9 -0) 📝 `src/common.h` (+5 -0) 📝 `src/s3fs.cpp` (+29 -8) 📝 `src/s3fs_cred.cpp` (+361 -11) 📝 `src/s3fs_cred.h` (+23 -1) ➕ `src/s3fs_extcred.h` (+144 -0) 📝 `src/s3fs_help.cpp` (+16 -0) </details> ### 📄 Description ## Relevant Issue (if applicable) #1068 ## Details ### Overview Allows an external shared library to be used instead of s3fs' built-in credentials(and tokens) processing. Shared libraries are expected to implement credential(and token) processing. This allows user to make implementations other than the built-in credential processing. For example, you can replace the built-in processing by providing the credential processing provided by `s3fs-sdk-cpp` as a shared library. And it is also possible to support servers that perform credential processing that is not compatible with AWS S3. (For example, IBM's credential processing for storage could be a shared library.) ### Details Add two options to s3fs, `credlib` and `credlib_ops`. Each definition is shown below: - `credlib` Specify the shared library name(or path) for this option. The specified shared library will be loaded at s3fs startup and unloaded at exit. - `credlib_ops` This option specifies the option string to be passed when loading(initializing) the shared library specified by `credlib`. This option parameter string is decided by the shared library. Specify an appropriate character string according to the contents. The built-in passwd_file, profile, use_session_token, ecs, ibm_iam_auth, ibm_iam_endpoint, imdsv1only and iam_role options are not available when using these options. The shared library needs to export the following functions(There are required and optional): - Required ``` const char* VersionS3fsCredential(bool detail); bool UpdateS3fsCredential(char** ppaccess_key_id, char** ppserect_access_key, char** ppaccess_token, long long* ptoken_expire, char** pperrstr); ``` - Optional ``` bool InitS3fsCredential(const char* popts, char** pperrstr); bool FreeS3fsCredential(char** pperrstr); ``` See the `s3fs_extcred.h` file for the contents of each function. ### Reference This PR is one of the solutions for #1068. ### Implementation example I made the credential processing of `aws-sdk-cpp` into this shared library. https://github.com/ggtakec/s3fs-fuse-awscred-lib I think anyone can use it and try it out. (We are also considering transferring this library to the s3fs-fuse organization if agreed.) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>