Authentication
In this article:
Authentication#
Requests to the object storage can be either authenticated or unauthenticated. Unauthenticated requests can be sent by anonymous users.
K2 Cloud object storage supports the following versions of AWS authentication:
Signature Version 2 (AWSv2);
Signature Version 4 (AWSv4).
Authenticated requests must contain the Authorization header. The header for request authentication according to AWSv4 includes the following parameters:
Parameter |
Description |
---|---|
AWS4-HMAC-SHA256 |
AWS signature type (AWS4) and signature algorithm (HMAC-SHA256) |
Credential |
Access key and request information in the format: <access-key>/<data>/<region>/<service>/aws4_request |
SignedHeaders |
List of headers used in the signature calculation in lower case and in alphabetical order, for example, |
Signature |
A request authentication signature calculated using the access key, request body hash, and request in canonical representation. |
Sample header for the request authentication:
Authorization: AWS4-HMAC-SHA256
Credential=project:user@company/20220603/{region}/s3/aws4_request,
SignedHeaders=host;x-amz-content-sha256;x-amz-date,
Signature=897f92a12dbd98b20bd133efc8ffa9011eac346ffa73065928368f32311b88a4
Note
If you plan to make REST API calls directly from the code, you must independently calculate the call authentication signature. This is a rather cumbersome procedure, so we recommend using AWS CLI or S3cmd.
if AWS Signature Version 4 is used for authentication, the signature is calculated as follows.