Hawkin
/
arangodb
mirror of https://gitee.com/bigwinds/arangodb
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Auth-related tests for audit logging (#8790)

This commit is contained in:
Dan Larkin-York 2019-04-18 04:45:41 -04:00 committed by Jan
parent 6eb986825e
commit 48fb15e94f
11 changed files with 14 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Documentation/Books/Manual/Security/Auditing/AuditConfiguration.md
View File

@ -38,5 +38,5 @@ By default, the server will log all audit events. Some low-priority events, such
as statistics operations, are logged with the `debug` log level. To keep such
events from cluttering the log, set the appropriate topic to `info`. All other
messages will be logged at the `info` level. Audit topics include
`audit-authentication`, `audit-collection`, `audit-database`, `audit-document`,
`audit-service`, and `audit-view`.
`audit-authentication`, `audit-authorization`, `audit-collection`,
`audit-database`, `audit-document`, `audit-service`, and `audit-view`.

8
Documentation/Books/Manual/Security/Auditing/AuditEvents.md
View File

@ -30,12 +30,6 @@ Authentication
Please note, that the user given as fourth part is the user that requested
the login. In general it will be unavailable.
### Password change required
```
2016-10-03 16:18:53 | server1 | audit-authentication | user1 | database1 | 127.0.0.1:62257 | http basic | password change required | /_api/version
```
### JWT login succeeded
```
@ -60,7 +54,7 @@ Authorization
### User not authorized to access database
```
2016-10-03 16:20:52 | server1 | audit-authentication | user1 | database2 | 127.0.0.1:62262 | http basic | not authorized | /_api/version
2016-10-03 16:20:52 | server1 | audit-authorization | user1 | database2 | 127.0.0.1:62262 | http basic | not authorized | /_api/version
```
Databases

3
Documentation/DocuBlocks/Rest/Administration/get_admin_modules_flush.md
View File

@ -222,6 +222,9 @@ One of the possible log levels.
@RESTBODYPARAM{audit-authentication,string,optional,string}
One of the possible log levels.
@RESTBODYPARAM{audit-authorization,string,optional,string}
One of the possible log levels.
@RESTBODYPARAM{audit-database,string,optional,string}
One of the possible log levels.

1
arangod/Utils/Events.cpp
View File

@ -29,7 +29,6 @@ void CredentialsMissing(GeneralRequest const&) {}
void LoggedIn(GeneralRequest const&, std::string const& username) {}
void CredentialsBad(GeneralRequest const&, std::string const& username) {}
void CredentialsBad(GeneralRequest const&, rest::AuthenticationMethod) {}
void PasswordChangeRequired(GeneralRequest const&) {}
void Authenticated(GeneralRequest const&, rest::AuthenticationMethod) {}
void NotAuthorized(GeneralRequest const&) {}
void CreateCollection(std::string const& db, std::string const& name, int result) {}

1
arangod/Utils/Events.h
View File

@ -42,7 +42,6 @@ void CredentialsMissing(GeneralRequest const&);
void LoggedIn(GeneralRequest const&, std::string const& username);
void CredentialsBad(GeneralRequest const&, std::string const& username);
void CredentialsBad(GeneralRequest const&, rest::AuthenticationMethod);
void PasswordChangeRequired(GeneralRequest const&);
void Authenticated(GeneralRequest const&, rest::AuthenticationMethod);
void NotAuthorized(GeneralRequest const&);
void CreateCollection(std::string const& db, std::string const& name, int result);

8
js/client/modules/@arangodb/testsuites/audit.js
View File

@ -69,11 +69,17 @@ function auditLog(onServer) {
};
options.auditLoggingEnabled = true;
const serverOptions = {
'server.authentication': 'true',
'server.jwt-secret': 'haxxmann',
'log.level': 'audit-authentication=info',
};
print(CYAN + 'Audit log server tests...' + RESET);
let testCases = tu.scanTestPaths(testPaths['audit_' + (onServer ? 'server' : 'client')]);
return tu.performTests(options, testCases, 'audit', onServer ? tu.runThere : tu.runInArangosh);
return tu.performTests(options, testCases, 'audit', onServer ? tu.runThere : tu.runInArangosh, serverOptions);
};
}

1
js/common/bootstrap/errors.js
View File

@ -239,7 +239,6 @@
"ERROR_USER_INVALID_PASSWORD" : { "code" : 1701, "message" : "invalid password" },
"ERROR_USER_DUPLICATE" : { "code" : 1702, "message" : "duplicate user" },
"ERROR_USER_NOT_FOUND" : { "code" : 1703, "message" : "user not found" },
"ERROR_USER_CHANGE_PASSWORD" : { "code" : 1704, "message" : "user must change his password" },
"ERROR_USER_EXTERNAL" : { "code" : 1705, "message" : "user is external" },
"ERROR_SERVICE_INVALID_NAME" : { "code" : 1750, "message" : "invalid service name" },
"ERROR_SERVICE_INVALID_MOUNT" : { "code" : 1751, "message" : "invalid mount" },

1
lib/Basics/errors.dat
View File

@ -308,7 +308,6 @@ ERROR_USER_INVALID_NAME,1700,"invalid user name","Will be raised when an invalid
ERROR_USER_INVALID_PASSWORD,1701,"invalid password","Will be raised when an invalid password is used."
ERROR_USER_DUPLICATE,1702,"duplicate user","Will be raised when a user name already exists."
ERROR_USER_NOT_FOUND,1703,"user not found","Will be raised when a user name is updated that does not exist."
ERROR_USER_CHANGE_PASSWORD,1704,"user must change his password","Will be raised when the user must change his password."
ERROR_USER_EXTERNAL,1705,"user is external","Will be raised when the user is authenicated by an external server."
###############################################################################

1
lib/Basics/voc-errors.cpp
View File

@ -238,7 +238,6 @@ void TRI_InitializeErrorMessages() {
REG_ERROR(ERROR_USER_INVALID_PASSWORD, "invalid password");
REG_ERROR(ERROR_USER_DUPLICATE, "duplicate user");
REG_ERROR(ERROR_USER_NOT_FOUND, "user not found");
REG_ERROR(ERROR_USER_CHANGE_PASSWORD, "user must change his password");
REG_ERROR(ERROR_USER_EXTERNAL, "user is external");
REG_ERROR(ERROR_SERVICE_INVALID_NAME, "invalid service name");
REG_ERROR(ERROR_SERVICE_INVALID_MOUNT, "invalid mount");

5
lib/Basics/voc-errors.h
View File

@ -1276,11 +1276,6 @@ constexpr int TRI_ERROR_USER_DUPLICATE
/// Will be raised when a user name is updated that does not exist.
constexpr int TRI_ERROR_USER_NOT_FOUND = 1703;
/// 1704: ERROR_USER_CHANGE_PASSWORD
/// "user must change his password"
/// Will be raised when the user must change his password.
constexpr int TRI_ERROR_USER_CHANGE_PASSWORD = 1704;
/// 1705: ERROR_USER_EXTERNAL
/// "user is external"
/// Will be raised when the user is authenicated by an external server.

1
lib/Logger/LogTopic.cpp
View File

@ -147,6 +147,7 @@ LogTopic Logger::VIEWS("views", LogLevel::FATAL);
LogTopic LdapFeature::LDAP("ldap", LogLevel::INFO);
LogTopic AuditFeature::AUDIT_AUTHENTICATION("audit-authentication", LogLevel::DEBUG);
LogTopic AuditFeature::AUDIT_AUTHORIZATION("audit-authorization", LogLevel::INFO);
LogTopic AuditFeature::AUDIT_DATABASE("audit-database", LogLevel::INFO);
LogTopic AuditFeature::AUDIT_COLLECTION("audit-collection", LogLevel::INFO);
LogTopic AuditFeature::AUDIT_VIEW("audit-view", LogLevel::INFO);