Client upload to storage without having primary storage keys

[wwaites]

Reverse engineer boto and work out how to get headers to support upload to google storage without holding api keys.

This would lead to an extension to OFS.

This analysis should inform (and go hand-in-hand) with the implementation of ticket:879 (Storage Auth API in CKAN).

• master ticket #852

[wwaites]

done in ​http://bitbucket.org/ww/ofs need to merge back into main ofs repo

[pudo]

Looking at the changeset this cannot be functional yet: where is the implementation of the policy document exchange. It seems to me like this is currently adding the actual credentials to the request (self.ofs.conn.add_aws_auth_header(headers, 'PUT', path)).

c.f.:

• ​http://doc.s3.amazonaws.com/proposals/post.html#Form_Fields
• ​http://code.google.com/apis/storage/docs/reference-methods.html#postobject

[wwaites]

we don't need a policy document exchange. it's simpler than that. the "server" instance has already permissions to upload. it just calculates the headers and such that are needed (based on the "client"'s initial headers) and gives them to the "client" the client then uploads without knowing the "server"'s credentials. The "client" never needs any of its own goostor credentials at all.

the only separate step is to make the widget readable by the world.

ticket #879 is to expose this as a small set of API calls.