Add cadf auditing to credentials

added audit logging to credentials.

Closes-bug: #1831918
Change-Id: I028a86f44e049bcc7c54e844bfc91aa0b11cd541
This commit is contained in:
Nathan Oyler 2019-06-10 10:32:05 -07:00
parent 485a6b2170
commit 579cc19857
3 changed files with 23 additions and 4 deletions

View File

@ -139,7 +139,8 @@ class CredentialResource(ks_flask.ResourceBase):
trust_id = getattr(self.oslo_context, 'trust_id', None)
ref = self._assign_unique_id(
self._normalize_dict(credential), trust_id=trust_id)
ref = PROVIDERS.credential_api.create_credential(ref['id'], ref)
ref = PROVIDERS.credential_api.create_credential(ref['id'], ref,
initiator=self.audit_initiator)
return self.wrap_member(ref), http_client.CREATED
def patch(self, credential_id):
@ -164,7 +165,8 @@ class CredentialResource(ks_flask.ResourceBase):
build_target=_build_target_enforcement
)
return (PROVIDERS.credential_api.delete_credential(credential_id),
return (PROVIDERS.credential_api.delete_credential(credential_id,
initiator=self.audit_initiator),
http_client.NO_CONTENT)

View File

@ -22,6 +22,7 @@ from keystone.common import manager
from keystone.common import provider_api
import keystone.conf
from keystone import exception
from keystone import notifications
CONF = keystone.conf.CONF
@ -40,6 +41,8 @@ class Manager(manager.Manager):
driver_namespace = 'keystone.credential'
_provides_api = 'credential_api'
_CRED = 'credential'
def __init__(self):
super(Manager, self).__init__(CONF.credential.driver)
@ -112,7 +115,8 @@ class Manager(manager.Manager):
def _get_credential(self, credential_id):
return self.driver.get_credential(credential_id)
def create_credential(self, credential_id, credential):
def create_credential(self, credential_id, credential,
initiator=None):
"""Create a credential."""
credential_copy = self._encrypt_credential(credential)
ref = self.driver.create_credential(credential_id, credential_copy)
@ -129,6 +133,10 @@ class Manager(manager.Manager):
ref.pop('key_hash', None)
ref.pop('encrypted_blob', None)
ref['blob'] = credential['blob']
notifications.Audit.created(
self._CRED,
credential_id,
initiator)
return ref
def _validate_credential_update(self, credential_id, credential):
@ -172,7 +180,8 @@ class Manager(manager.Manager):
ref['blob'] = existing_blob
return ref
def delete_credential(self, credential_id):
def delete_credential(self, credential_id,
initiator=None):
"""Delete a credential."""
cred = self.get_credential(credential_id)
self.driver.delete_credential(credential_id)
@ -183,6 +192,8 @@ class Manager(manager.Manager):
self._list_credentials_for_user.invalidate(self,
cred['user_id'],
None)
notifications.Audit.deleted(
self._CRED, credential_id, initiator)
def delete_credentials_for_project(self, project_id):
"""Delete all credentials for a project."""

View File

@ -0,0 +1,6 @@
---
fixes:
- |
[`bug 1831918 <https://bugs.launchpad.net/keystone/+bug/1831918>`_]
Credentials now logs cadf audit messages.