mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-01 19:12:14 +00:00
test(kms): add an end-to-end negative authorization matrix
Covers the admin and SSE-KMS planes for a wrong identity, a wrong key, a wrong action and an explicit Deny, each preceded by a positive control so a denial cannot be an unpropagated policy. SSE-S3 and unencrypted objects are asserted to stay exempt.
This commit is contained in:
overtrue
@@ -0,0 +1,483 @@
|
||||
// Copyright 2024 RustFS Team
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
//! Negative authorization matrix for per-key KMS access control.
|
||||
//!
|
||||
//! Every case here is an end-to-end denial that the pre-`kms` resource server
|
||||
//! allowed, so a regression that reopens one of them fails this file rather than
|
||||
//! only a unit test. The matrix varies one dimension at a time:
|
||||
//!
|
||||
//! - **wrong identity**: a caller holding S3 rights but no `kms` grant at all
|
||||
//! - **wrong key**: a caller scoped to key A naming key B
|
||||
//! - **wrong action**: a caller holding `kms:GenerateDataKey` but not `kms:Decrypt`
|
||||
//! (and, on the admin plane, `kms:DisableKey` but not `kms:RotateKey`)
|
||||
//! - **wrong context**: an explicit `Deny` beating a wildcard `Allow`, and SSE-S3
|
||||
//! staying exempt from `kms` authorization
|
||||
//!
|
||||
//! Each matrix opens with a positive control. Without it a denial proves nothing:
|
||||
//! an identity whose policy has not propagated yet is denied everything.
|
||||
|
||||
use super::common::{LocalKMSTestEnvironment, create_key_with_specific_id};
|
||||
use crate::common::{admin_ok, admin_request, init_logging};
|
||||
use aws_sdk_s3::Client;
|
||||
use aws_sdk_s3::config::{Config, Credentials, Region};
|
||||
use aws_sdk_s3::error::ProvideErrorMetadata;
|
||||
use aws_sdk_s3::primitives::ByteStream;
|
||||
use aws_sdk_s3::types::ServerSideEncryption;
|
||||
use serial_test::serial;
|
||||
use std::time::Duration;
|
||||
use tracing::info;
|
||||
|
||||
type TestResult = Result<(), Box<dyn std::error::Error + Send + Sync>>;
|
||||
|
||||
const ALLOWED_KEY: &str = "kms-matrix-allowed-key";
|
||||
const OTHER_KEY: &str = "kms-matrix-other-key";
|
||||
const BUCKET: &str = "kms-authz-matrix";
|
||||
const SECRET: &str = "kms-matrix-secret";
|
||||
const PAYLOAD: &[u8] = b"kms authorization matrix payload";
|
||||
|
||||
/// How long an identity change may take to reach the request path.
|
||||
const IAM_PROPAGATION: Duration = Duration::from_secs(20);
|
||||
|
||||
fn s3_client(url: &str, access_key: &str, secret_key: &str) -> Client {
|
||||
let config = Config::builder()
|
||||
.credentials_provider(Credentials::new(access_key, secret_key, None, None, "kms-authz-matrix"))
|
||||
.region(Region::new("us-east-1"))
|
||||
.endpoint_url(url)
|
||||
.force_path_style(true)
|
||||
.behavior_version_latest()
|
||||
.build();
|
||||
Client::from_conf(config)
|
||||
}
|
||||
|
||||
/// Start a server whose SSE-KMS data path authorizes against the named key.
|
||||
///
|
||||
/// The enforcement switch defaults to off for compatibility, so it has to be set
|
||||
/// explicitly; without it every negative case below would silently pass as an allow.
|
||||
async fn start_enforcing_server(env: &mut LocalKMSTestEnvironment, extra_env: &[(&str, &str)]) -> TestResult {
|
||||
create_key_with_specific_id(&env.kms_keys_dir, ALLOWED_KEY).await?;
|
||||
create_key_with_specific_id(&env.kms_keys_dir, OTHER_KEY).await?;
|
||||
|
||||
let key_dir = env.kms_keys_dir.clone();
|
||||
let args = vec![
|
||||
"--kms-enable",
|
||||
"--kms-backend",
|
||||
"local",
|
||||
"--kms-key-dir",
|
||||
key_dir.as_str(),
|
||||
"--kms-default-key-id",
|
||||
ALLOWED_KEY,
|
||||
];
|
||||
|
||||
let mut envs = vec![("RUSTFS_KMS_ALLOW_INSECURE_DEV_DEFAULTS", "true")];
|
||||
envs.extend_from_slice(extra_env);
|
||||
|
||||
env.base_env.start_rustfs_server_with_env(args, &envs).await?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Create `user` with `policy_document` attached under a canned policy of the same name.
|
||||
async fn provision_user(env: &LocalKMSTestEnvironment, user: &str, policy_document: &str) -> TestResult {
|
||||
admin_ok(
|
||||
&env.base_env,
|
||||
http::Method::PUT,
|
||||
&format!("/rustfs/admin/v3/add-canned-policy?name={user}"),
|
||||
Some(policy_document.to_string()),
|
||||
)
|
||||
.await?;
|
||||
provision_user_with_policy(env, user, user).await
|
||||
}
|
||||
|
||||
/// Create `user` and attach an existing policy (built-in or canned) by name.
|
||||
async fn provision_user_with_policy(env: &LocalKMSTestEnvironment, user: &str, policy_name: &str) -> TestResult {
|
||||
admin_ok(
|
||||
&env.base_env,
|
||||
http::Method::PUT,
|
||||
&format!("/rustfs/admin/v3/add-user?accessKey={user}"),
|
||||
Some(serde_json::json!({ "secretKey": SECRET, "status": "enabled" }).to_string()),
|
||||
)
|
||||
.await?;
|
||||
admin_ok(
|
||||
&env.base_env,
|
||||
http::Method::PUT,
|
||||
&format!("/rustfs/admin/v3/set-user-or-group-policy?policyName={policy_name}&userOrGroup={user}&isGroup=false"),
|
||||
None,
|
||||
)
|
||||
.await?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// The S3 half of every data-path policy below: full object access, no KMS grant.
|
||||
fn s3_full_access_statement() -> serde_json::Value {
|
||||
serde_json::json!({
|
||||
"Effect": "Allow",
|
||||
"Action": ["s3:*"],
|
||||
"Resource": ["arn:aws:s3:::*"]
|
||||
})
|
||||
}
|
||||
|
||||
fn policy_document(statements: Vec<serde_json::Value>) -> String {
|
||||
serde_json::json!({ "Version": "2012-10-17", "Statement": statements }).to_string()
|
||||
}
|
||||
|
||||
async fn put_sse_kms(client: &Client, key: &str, kms_key_id: &str) -> Result<(), aws_sdk_s3::Error> {
|
||||
client
|
||||
.put_object()
|
||||
.bucket(BUCKET)
|
||||
.key(key)
|
||||
.body(ByteStream::from_static(PAYLOAD))
|
||||
.server_side_encryption(ServerSideEncryption::AwsKms)
|
||||
.ssekms_key_id(kms_key_id)
|
||||
.send()
|
||||
.await
|
||||
.map(|_| ())
|
||||
.map_err(aws_sdk_s3::Error::from)
|
||||
}
|
||||
|
||||
/// Assert the operation failed with `AccessDenied` rather than any other error.
|
||||
///
|
||||
/// A bare `is_err` would also accept `KMSKeyDisabled` or an internal error, which
|
||||
/// would hide both a leak of key state and an outage masquerading as a denial.
|
||||
fn assert_access_denied<T: std::fmt::Debug>(result: Result<T, aws_sdk_s3::Error>, what: &str) {
|
||||
let error = result.expect_err(&format!("{what} must be denied"));
|
||||
assert_eq!(error.code(), Some("AccessDenied"), "{what} must fail with AccessDenied: {error:?}");
|
||||
}
|
||||
|
||||
/// Retry an SSE-KMS write until the identity's policy has reached the request path.
|
||||
async fn wait_for_sse_kms_write(client: &Client, key: &str, kms_key_id: &str) -> TestResult {
|
||||
let deadline = tokio::time::Instant::now() + IAM_PROPAGATION;
|
||||
loop {
|
||||
match put_sse_kms(client, key, kms_key_id).await {
|
||||
Ok(()) => return Ok(()),
|
||||
Err(error) if tokio::time::Instant::now() >= deadline => {
|
||||
return Err(format!("positive control never became authorized: {error:?}").into());
|
||||
}
|
||||
Err(_) => tokio::time::sleep(Duration::from_millis(500)).await,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Retry an admin call until it stops returning 403, i.e. the policy is live.
|
||||
async fn wait_for_admin_success(
|
||||
env: &LocalKMSTestEnvironment,
|
||||
user: &str,
|
||||
method: http::Method,
|
||||
path: &str,
|
||||
body: Option<String>,
|
||||
) -> TestResult {
|
||||
let deadline = tokio::time::Instant::now() + IAM_PROPAGATION;
|
||||
loop {
|
||||
let (status, response) = admin_request(&env.base_env.url, method.clone(), path, body.clone(), user, SECRET).await?;
|
||||
if status.is_success() {
|
||||
return Ok(());
|
||||
}
|
||||
if tokio::time::Instant::now() >= deadline {
|
||||
return Err(format!("positive control never became authorized: {method} {path} -> {status} {response}").into());
|
||||
}
|
||||
tokio::time::sleep(Duration::from_millis(500)).await;
|
||||
}
|
||||
}
|
||||
|
||||
async fn assert_admin_denied(
|
||||
env: &LocalKMSTestEnvironment,
|
||||
user: &str,
|
||||
method: http::Method,
|
||||
path: &str,
|
||||
body: Option<String>,
|
||||
what: &str,
|
||||
) -> TestResult {
|
||||
let (status, response) = admin_request(&env.base_env.url, method, path, body, user, SECRET).await?;
|
||||
assert_eq!(status.as_u16(), 403, "{what} must be denied, got {status}: {response}");
|
||||
assert!(response.contains("AccessDenied"), "{what} must carry AccessDenied: {response}");
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn disable_body(key_id: &str) -> String {
|
||||
serde_json::json!({ "key_id": key_id }).to_string()
|
||||
}
|
||||
|
||||
/// Data-path matrix: SSE-KMS writes and reads are authorized against the resolved key.
|
||||
#[tokio::test]
|
||||
#[serial]
|
||||
async fn sse_kms_per_key_authorization_negative_matrix() -> TestResult {
|
||||
init_logging();
|
||||
|
||||
let mut env = LocalKMSTestEnvironment::new().await?;
|
||||
start_enforcing_server(&mut env, &[("RUSTFS_KMS_ENFORCE_SSE_KEY_POLICY", "true")]).await?;
|
||||
env.base_env.create_test_bucket(BUCKET).await?;
|
||||
|
||||
// Scoped to ALLOWED_KEY only.
|
||||
provision_user(
|
||||
&env,
|
||||
"kmsmatrixscoped",
|
||||
&policy_document(vec![
|
||||
s3_full_access_statement(),
|
||||
serde_json::json!({
|
||||
"Effect": "Allow",
|
||||
"Action": ["kms:GenerateDataKey", "kms:Decrypt"],
|
||||
"Resource": [format!("arn:aws:kms:::key/{ALLOWED_KEY}")]
|
||||
}),
|
||||
]),
|
||||
)
|
||||
.await?;
|
||||
// S3 rights only: the identity shape that existed before per-key authorization.
|
||||
provision_user(&env, "kmsmatrixs3only", &policy_document(vec![s3_full_access_statement()])).await?;
|
||||
// May wrap a data key but may never unwrap one.
|
||||
provision_user(
|
||||
&env,
|
||||
"kmsmatrixwriter",
|
||||
&policy_document(vec![
|
||||
s3_full_access_statement(),
|
||||
serde_json::json!({
|
||||
"Effect": "Allow",
|
||||
"Action": ["kms:GenerateDataKey"],
|
||||
"Resource": ["arn:aws:kms:::*"]
|
||||
}),
|
||||
]),
|
||||
)
|
||||
.await?;
|
||||
// Wildcard allow, explicit deny on one key.
|
||||
provision_user(
|
||||
&env,
|
||||
"kmsmatrixdenied",
|
||||
&policy_document(vec![
|
||||
s3_full_access_statement(),
|
||||
serde_json::json!({
|
||||
"Effect": "Allow",
|
||||
"Action": ["kms:*"],
|
||||
"Resource": ["arn:aws:kms:::*"]
|
||||
}),
|
||||
serde_json::json!({
|
||||
"Effect": "Deny",
|
||||
"Action": ["kms:*"],
|
||||
"Resource": [format!("arn:aws:kms:::key/{OTHER_KEY}")]
|
||||
}),
|
||||
]),
|
||||
)
|
||||
.await?;
|
||||
|
||||
let scoped = s3_client(&env.base_env.url, "kmsmatrixscoped", SECRET);
|
||||
let s3_only = s3_client(&env.base_env.url, "kmsmatrixs3only", SECRET);
|
||||
let writer = s3_client(&env.base_env.url, "kmsmatrixwriter", SECRET);
|
||||
let denied = s3_client(&env.base_env.url, "kmsmatrixdenied", SECRET);
|
||||
|
||||
// --- positive control -----------------------------------------------------
|
||||
wait_for_sse_kms_write(&scoped, "scoped/allowed", ALLOWED_KEY).await?;
|
||||
let read = scoped.get_object().bucket(BUCKET).key("scoped/allowed").send().await?;
|
||||
assert_eq!(read.body.collect().await?.into_bytes().as_ref(), PAYLOAD);
|
||||
info!("positive control: scoped identity may write and read under its own key");
|
||||
|
||||
// --- wrong key ------------------------------------------------------------
|
||||
assert_access_denied(
|
||||
put_sse_kms(&scoped, "scoped/other", OTHER_KEY).await,
|
||||
"SSE-KMS write under a key outside the identity's scope",
|
||||
);
|
||||
|
||||
// --- wrong identity -------------------------------------------------------
|
||||
assert_access_denied(
|
||||
put_sse_kms(&s3_only, "s3only/allowed", ALLOWED_KEY).await,
|
||||
"SSE-KMS write by an identity holding no kms grant",
|
||||
);
|
||||
// The object the scoped identity wrote is readable by its owner only.
|
||||
assert_access_denied(
|
||||
s3_only
|
||||
.get_object()
|
||||
.bucket(BUCKET)
|
||||
.key("scoped/allowed")
|
||||
.send()
|
||||
.await
|
||||
.map(|_| ())
|
||||
.map_err(aws_sdk_s3::Error::from),
|
||||
"SSE-KMS read by an identity holding no kms grant",
|
||||
);
|
||||
|
||||
// --- wrong action ---------------------------------------------------------
|
||||
wait_for_sse_kms_write(&writer, "writer/allowed", ALLOWED_KEY).await?;
|
||||
assert_access_denied(
|
||||
writer
|
||||
.get_object()
|
||||
.bucket(BUCKET)
|
||||
.key("writer/allowed")
|
||||
.send()
|
||||
.await
|
||||
.map(|_| ())
|
||||
.map_err(aws_sdk_s3::Error::from),
|
||||
"SSE-KMS read by an identity holding kms:GenerateDataKey but not kms:Decrypt",
|
||||
);
|
||||
|
||||
// --- wrong context: explicit Deny beats a wildcard Allow -------------------
|
||||
wait_for_sse_kms_write(&denied, "denied/allowed", ALLOWED_KEY).await?;
|
||||
assert_access_denied(
|
||||
put_sse_kms(&denied, "denied/other", OTHER_KEY).await,
|
||||
"SSE-KMS write under a key covered by an explicit Deny",
|
||||
);
|
||||
|
||||
// --- wrong context: SSE-S3 is out of scope --------------------------------
|
||||
// SSE-S3 wraps its data key with a server-owned key the caller never names, so
|
||||
// it must stay reachable for an identity with no kms grant at all.
|
||||
s3_only
|
||||
.put_object()
|
||||
.bucket(BUCKET)
|
||||
.key("s3only/sse-s3")
|
||||
.body(ByteStream::from_static(PAYLOAD))
|
||||
.server_side_encryption(ServerSideEncryption::Aes256)
|
||||
.send()
|
||||
.await?;
|
||||
let sse_s3_read = s3_only.get_object().bucket(BUCKET).key("s3only/sse-s3").send().await?;
|
||||
assert_eq!(sse_s3_read.body.collect().await?.into_bytes().as_ref(), PAYLOAD);
|
||||
|
||||
// ... and so must an unencrypted object.
|
||||
s3_only
|
||||
.put_object()
|
||||
.bucket(BUCKET)
|
||||
.key("s3only/plain")
|
||||
.body(ByteStream::from_static(PAYLOAD))
|
||||
.send()
|
||||
.await?;
|
||||
s3_only.get_object().bucket(BUCKET).key("s3only/plain").send().await?;
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Admin-plane matrix: KMS key endpoints are authorized against the key they name.
|
||||
///
|
||||
/// Runs without the SSE enforcement switch: admin scoping is unconditional, and
|
||||
/// leaving the switch off proves the two planes are independent.
|
||||
#[tokio::test]
|
||||
#[serial]
|
||||
async fn kms_admin_per_key_authorization_negative_matrix() -> TestResult {
|
||||
init_logging();
|
||||
|
||||
let mut env = LocalKMSTestEnvironment::new().await?;
|
||||
start_enforcing_server(&mut env, &[]).await?;
|
||||
|
||||
// Built-in role templates, attached by name.
|
||||
provision_user_with_policy(&env, "kmsmatrixkeyadmin", "KMSKeyAdministrator").await?;
|
||||
provision_user_with_policy(&env, "kmsmatrixauditor", "KMSAuditor").await?;
|
||||
// A narrowed copy of the administrator template, scoped to one key.
|
||||
provision_user(
|
||||
&env,
|
||||
"kmsmatrixscopedadmin",
|
||||
&policy_document(vec![serde_json::json!({
|
||||
"Effect": "Allow",
|
||||
"Action": ["kms:DisableKey", "kms:EnableKey"],
|
||||
"Resource": [format!("arn:aws:kms:::key/{ALLOWED_KEY}")]
|
||||
})]),
|
||||
)
|
||||
.await?;
|
||||
|
||||
// --- positive control -----------------------------------------------------
|
||||
wait_for_admin_success(
|
||||
&env,
|
||||
"kmsmatrixkeyadmin",
|
||||
http::Method::POST,
|
||||
"/rustfs/admin/v3/kms/keys/disable",
|
||||
Some(disable_body(OTHER_KEY)),
|
||||
)
|
||||
.await?;
|
||||
admin_request(
|
||||
&env.base_env.url,
|
||||
http::Method::POST,
|
||||
"/rustfs/admin/v3/kms/keys/enable",
|
||||
Some(disable_body(OTHER_KEY)),
|
||||
"kmsmatrixkeyadmin",
|
||||
SECRET,
|
||||
)
|
||||
.await?;
|
||||
|
||||
// --- wrong action: the administrator template withholds service-wide powers -
|
||||
assert_admin_denied(
|
||||
&env,
|
||||
"kmsmatrixkeyadmin",
|
||||
http::Method::GET,
|
||||
"/rustfs/admin/v3/kms/config",
|
||||
None,
|
||||
"KMSKeyAdministrator reading the KMS backend configuration (kms:Configure)",
|
||||
)
|
||||
.await?;
|
||||
assert_admin_denied(
|
||||
&env,
|
||||
"kmsmatrixkeyadmin",
|
||||
http::Method::GET,
|
||||
"/rustfs/admin/v3/kms/backup",
|
||||
None,
|
||||
"KMSKeyAdministrator exporting a backup bundle (kms:Backup)",
|
||||
)
|
||||
.await?;
|
||||
// Separation of duties: managing a key never implies using it.
|
||||
assert_admin_denied(
|
||||
&env,
|
||||
"kmsmatrixkeyadmin",
|
||||
http::Method::POST,
|
||||
"/rustfs/admin/v3/kms/generate-data-key",
|
||||
Some(serde_json::json!({ "key_id": ALLOWED_KEY }).to_string()),
|
||||
"KMSKeyAdministrator generating a data key (kms:GenerateDataKey)",
|
||||
)
|
||||
.await?;
|
||||
|
||||
// --- wrong action: the auditor template is read-only ----------------------
|
||||
wait_for_admin_success(&env, "kmsmatrixauditor", http::Method::GET, "/rustfs/admin/v3/kms/keys", None).await?;
|
||||
assert_admin_denied(
|
||||
&env,
|
||||
"kmsmatrixauditor",
|
||||
http::Method::POST,
|
||||
"/rustfs/admin/v3/kms/keys/disable",
|
||||
Some(disable_body(ALLOWED_KEY)),
|
||||
"KMSAuditor disabling a key (kms:DisableKey)",
|
||||
)
|
||||
.await?;
|
||||
|
||||
// --- wrong key ------------------------------------------------------------
|
||||
wait_for_admin_success(
|
||||
&env,
|
||||
"kmsmatrixscopedadmin",
|
||||
http::Method::POST,
|
||||
"/rustfs/admin/v3/kms/keys/disable",
|
||||
Some(disable_body(ALLOWED_KEY)),
|
||||
)
|
||||
.await?;
|
||||
assert_admin_denied(
|
||||
&env,
|
||||
"kmsmatrixscopedadmin",
|
||||
http::Method::POST,
|
||||
"/rustfs/admin/v3/kms/keys/disable",
|
||||
Some(disable_body(OTHER_KEY)),
|
||||
"key-scoped administrator disabling a key outside its scope",
|
||||
)
|
||||
.await?;
|
||||
// --- wrong action, same key ----------------------------------------------
|
||||
assert_admin_denied(
|
||||
&env,
|
||||
"kmsmatrixscopedadmin",
|
||||
http::Method::POST,
|
||||
"/rustfs/admin/v3/kms/keys/rotate",
|
||||
Some(disable_body(ALLOWED_KEY)),
|
||||
"key-scoped administrator rotating a key it may only enable and disable",
|
||||
)
|
||||
.await?;
|
||||
|
||||
// --- wrong identity -------------------------------------------------------
|
||||
provision_user(&env, "kmsmatrixnokms", &policy_document(vec![s3_full_access_statement()])).await?;
|
||||
assert_admin_denied(
|
||||
&env,
|
||||
"kmsmatrixnokms",
|
||||
http::Method::POST,
|
||||
"/rustfs/admin/v3/kms/keys/disable",
|
||||
Some(disable_body(ALLOWED_KEY)),
|
||||
"identity holding no kms grant disabling a key",
|
||||
)
|
||||
.await?;
|
||||
|
||||
Ok(())
|
||||
}
|
||||
@@ -53,3 +53,6 @@ mod copy_object_version_restore_sse_test;
|
||||
|
||||
#[cfg(test)]
|
||||
mod configured_roundtrip_test;
|
||||
|
||||
#[cfg(test)]
|
||||
mod kms_authorization_negative_matrix_test;
|
||||
|
||||
@@ -21,7 +21,7 @@ Rules worth knowing before writing a policy:
|
||||
- A statement carrying a KMS resource with non-KMS actions is rejected.
|
||||
- A KMS statement with **no** resource matches every key. This is the legacy form and stays valid, so existing policies keep their current effect.
|
||||
- A KMS statement whose resources are S3 ARNs predates KMS resources. It is still loadable, but the S3 patterns never constrained key access, so evaluation ignores them, treats the statement as unscoped, and logs a warning. Rewrite these with real KMS resources.
|
||||
- Bucket policies reject `kms:` statements outright. KMS grants belong to identities.
|
||||
- `PutBucketPolicy` rejects any statement carrying a `kms:` action or a KMS resource. KMS grants belong to identities. Bucket policies stored before this check still load; evaluation skips their pure-KMS statements and warns.
|
||||
- `Deny` wins, as everywhere else: a `Deny` on `arn:aws:kms:::key/payroll-*` overrides an `Allow` on `arn:aws:kms:::*`.
|
||||
- The key identifier matched is the one the request names, before any alias resolution.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user