Ceph » rgw

create bucket request originating from non-master zone fails with 'Access Denied' error. this is due to signature mismatch.

on primary, the canonical request looks like:

PUT /test-bucket/
rgwx-uid=test&rgwx-zonegroup=25dcfb3b-f19e-4c2c-9a94-f35904c4fa8f
date:Tue Jan 27 06:11:02 2026
x-amz-content-sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 ---> unsigned payload hash
x-amz-date:20260127T061102Z

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. ---> unsigned payload hash

on secondary:

PUT /test-bucket/
rgwx-uid=test&rgwx-zonegroup=25dcfb3b-f19e-4c2c-9a94-f35904c4fa8f
date:Tue Jan 27 06:11:02 2026
x-amz-content-sha256:UNSIGNED-PAYLOAD ---> should have been the unsigned payload hash
x-amz-date:20260127T061102Z

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" ---> unsigned payload hash

the canonical header values are different on both sites causing client signature and server signature to be different.

this is because when the secondary's AWSSignerV4::prepare() is called while signing the request,
it sets UNSIGNED-PAYLOAD in the canonical headers instead of the hash.
probably a regression from https://github.com/ceph/ceph/pull/65723.
the secondary zone is overriding the header value with UNSIGNED-PAYLOAD for the canonical headers,
but keeping the actual hash for the payload hash line