pycadf/doc/source/middleware.rst

Audit middleware

The pyCADF library provides an optional WSGI middleware filter which allows the ability to audit api requests for each component of OpenStack.

The audit middleware filter utilises environment variables to build the CADF event.

The figure above shows the middleware in Nova's pipeline.

Enabling audit middleware

To enable the audit middleware, the following requirements need to be satisfied:

1. pyCADF library must be added to the requirements file of the project to be audited.
2. The project should utilise oslo.messaging notification system.

Note

If the project utilises oslo's old notification system, a compatible middleware can be synced from oslo-incubator's middleware code base.

If the above requirements are satisfied, auditing can be enabled by editing the project's api-paste.ini file to include the following filter definition:

[filter:audit]
paste.filter_factory = pycadf.middleware.audit:AuditMiddleware.factory

or

[filter:audit]
paste.filter_factory = <project>.openstack.common.middleware.audit:AuditMiddleware.factory

The filter should be included after Keystone's auth_token middleware so it can utilise environment variables set by Keystone's middleware. Below is an example using Nova's WSGI pipeline:

[composite:openstack_compute_api_v2]
use = call:nova.api.auth:pipeline_factory
noauth = faultwrap sizelimit noauth ratelimit osapi_compute_app_v2
keystone = faultwrap sizelimit authtoken keystonecontext ratelimit audit osapi_compute_app_v2
keystone_nolimit = faultwrap sizelimit authtoken keystonecontext audit osapi_compute_app_v2

Configure audit middleware

To properly audit api requests, the audit middleware requires an api_audit_map.conf to be defined. The project's corresponding api_audit_map.conf file is included in the pyCADF library.

By default, the audit middleware filter expects the map file to be located in the same folder as the other conf files related to the project (ie.'/etc/<project>' folder). This default functionality is to be deprecated and so the location should be specified explicitly by adding the path to the 'audit_map_file' option of the filter definition:

[filter:audit]
paste.filter_factory = pycadf.middleware.audit:AuditMiddleware.factory
audit_map_file = /etc/nova/api_audit_map.conf

Additional options can be set:

[filter:audit]
paste.filter_factory = pycadf.middleware.audit:AuditMiddleware.factory
audit_map_file = /etc/nova/api_audit_map.conf
service_name = test # opt to set HTTP_X_SERVICE_NAME environ variable
ignore_req_list = GET,POST # opt to ignore specific requests