Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Audit Logging for Extensions #5

Merged
merged 2 commits into from
Jun 27, 2023
Merged

Audit Logging for Extensions #5

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8503358
turn on audit logging
MaciejMierzwa Jun 22, 2023
3c397e2
add privileges info
MaciejMierzwa Jun 23, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions src/main/java/org/opensearch/security/filter/SecurityRestFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,11 +177,10 @@ private boolean authorizeRequest(RestHandler original, RestRequest request, Rest
log.debug(pres.toString());
}
if (pres.isAllowed()) {
// TODO make sure this is audit logged
log.debug("Request has been granted");
// auditLog.logGrantedPrivileges(action, request, task);
auditLog.logGrantedPrivileges(user.getName(), request);
} else {
// auditLog.logMissingPrivileges(action, request, task);
auditLog.logMissingPrivileges(route.name(), user.getName(), request);
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is there a difference in adding this route.name() here? Maybe i missed it in the logs you posted

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you're right, it didn't do anything. It turns about this parameter wasn't used anywhere in one of the methods down the line. Added it in AbstractAuditLog and here's how logs look like now:
audit_request_privilege is logged correctly

{
                "_index": "security-auditlog-2023.06.23",
                "_id": "KJVs54gBDjJ9Ce5u7dZD",
                "_score": null,
                "_source": {
                    "audit_cluster_name": "opensearch",
                    "audit_node_name": "node",
                    "audit_rest_request_method": "POST",
                    "audit_category": "MISSING_PRIVILEGES",
                    "audit_request_origin": "REST",
                    "audit_request_body": "{ }",
                    "audit_node_id": "dwo7slt-SYiWN0z_aajNYQ",
                    "audit_request_layer": "REST",
                    "audit_rest_request_path": "/_extensions/_hw/hello",
                    "@timestamp": "2023-06-23T08:44:15.545+00:00",
                    "audit_format_version": 4,
                    "audit_request_remote_address": "127.0.0.1",
                    "audit_request_privilege": "hw:greet_with_adjective",
                    "audit_node_host_address": "127.0.0.1",
                    "audit_rest_request_headers": {
                        "x-http2-stream-id": [
                            "1"
                        ],
                        "content-length": [
                            "3"
                        ],
                        "host": [
                            "localhost:9200"
                        ],
                        "x-http2-scheme": [
                            "https"
                        ],
                        "content-type": [
                            "application/json"
                        ],
                        "user-agent": [
                            "curl/7.81.0"
                        ],
                        "accept": [
                            "*/*"
                        ]
                    },
                    "audit_request_effective_user": "new-user",
                    "audit_node_host_name": "127.0.0.1"
                },
                "sort": [
                    1687509855545
                ]
            },
            {
                "_index": "security-auditlog-2023.06.23",
                "_id": "J5Vs54gBDjJ9Ce5u7dZD",
                "_score": null,
                "_source": {
                    "audit_cluster_name": "opensearch",
                    "audit_node_name": "node",
                    "audit_request_initiating_user": "new-user",
                    "audit_rest_request_method": "POST",
                    "audit_category": "AUTHENTICATED",
                    "audit_request_origin": "REST",
                    "audit_request_body": "{ }",
                    "audit_node_id": "dwo7slt-SYiWN0z_aajNYQ",
                    "audit_request_layer": "REST",
                    "audit_rest_request_path": "/_extensions/_hw/hello",
                    "@timestamp": "2023-06-23T08:44:12.445+00:00",
                    "audit_request_effective_user_is_admin": false,
                    "audit_format_version": 4,
                    "audit_request_remote_address": "127.0.0.1",
                    "audit_node_host_address": "127.0.0.1",
                    "audit_rest_request_headers": {
                        "x-http2-stream-id": [
                            "1"
                        ],
                        "content-length": [
                            "3"
                        ],
                        "host": [
                            "localhost:9200"
                        ],
                        "x-http2-scheme": [
                            "https"
                        ],
                        "content-type": [
                            "application/json"
                        ],
                        "user-agent": [
                            "curl/7.81.0"
                        ],
                        "accept": [
                            "*/*"
                        ]
                    },
                    "audit_request_effective_user": "new-user",
                    "audit_node_host_name": "127.0.0.1"
                },
                "sort": [
                    1687509852445
                ]
            }

String err;
if (!pres.getMissingSecurityRoles().isEmpty()) {
err = String.format("No mapping for %s on roles %s", user, pres.getMissingSecurityRoles());
Expand Down