Hawkin
/
arangodb
mirror of https://gitee.com/bigwinds/arangodb
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Auth-related tests for audit logging (#8790)

This commit is contained in:
Dan Larkin-York 2019-04-18 04:45:41 -04:00 committed by Jan
parent 6eb986825e
commit 48fb15e94f
11 changed files with 14 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Documentation/Books/Manual/Security/Auditing/AuditConfiguration.md
View File

@ -38,5 +38,5 @@ By default, the server will log all audit events. Some low-priority events, such
as statistics operations, are logged with the `debug` log level. To keep such as statistics operations, are logged with the `debug` log level. To keep such
events from cluttering the log, set the appropriate topic to `info`. All other events from cluttering the log, set the appropriate topic to `info`. All other
messages will be logged at the `info` level. Audit topics include messages will be logged at the `info` level. Audit topics include
`audit-authentication`, `audit-collection`, `audit-database`, `audit-document`, `audit-authentication`, `audit-authorization`, `audit-collection`,
`audit-service`, and `audit-view`. `audit-database`, `audit-document`, `audit-service`, and `audit-view`.

8
Documentation/Books/Manual/Security/Auditing/AuditEvents.md
View File

@ -30,12 +30,6 @@ Authentication
Please note, that the user given as fourth part is the user that requested Please note, that the user given as fourth part is the user that requested
the login. In general it will be unavailable. the login. In general it will be unavailable.
### Password change required
```
2016-10-03 16:18:53 | server1 | audit-authentication | user1 | database1 | 127.0.0.1:62257 | http basic | password change required | /_api/version
```
### JWT login succeeded ### JWT login succeeded
``` ```
@ -60,7 +54,7 @@ Authorization
### User not authorized to access database ### User not authorized to access database
``` ```
2016-10-03 16:20:52 | server1 | audit-authentication | user1 | database2 | 127.0.0.1:62262 | http basic | not authorized | /_api/version 2016-10-03 16:20:52 | server1 | audit-authorization | user1 | database2 | 127.0.0.1:62262 | http basic | not authorized | /_api/version
``` ```
Databases Databases

3
Documentation/DocuBlocks/Rest/Administration/get_admin_modules_flush.md
View File

@ -222,6 +222,9 @@ One of the possible log levels.
@RESTBODYPARAM{audit-authentication,string,optional,string} @RESTBODYPARAM{audit-authentication,string,optional,string}
One of the possible log levels. One of the possible log levels.
@RESTBODYPARAM{audit-authorization,string,optional,string}
One of the possible log levels.
@RESTBODYPARAM{audit-database,string,optional,string} @RESTBODYPARAM{audit-database,string,optional,string}
One of the possible log levels. One of the possible log levels.

1
arangod/Utils/Events.cpp
View File

@ -29,7 +29,6 @@ void CredentialsMissing(GeneralRequest const&) {}
void LoggedIn(GeneralRequest const&, std::string const& username) {} void LoggedIn(GeneralRequest const&, std::string const& username) {}
void CredentialsBad(GeneralRequest const&, std::string const& username) {} void CredentialsBad(GeneralRequest const&, std::string const& username) {}
void CredentialsBad(GeneralRequest const&, rest::AuthenticationMethod) {} void CredentialsBad(GeneralRequest const&, rest::AuthenticationMethod) {}
void PasswordChangeRequired(GeneralRequest const&) {}
void Authenticated(GeneralRequest const&, rest::AuthenticationMethod) {} void Authenticated(GeneralRequest const&, rest::AuthenticationMethod) {}
void NotAuthorized(GeneralRequest const&) {} void NotAuthorized(GeneralRequest const&) {}
void CreateCollection(std::string const& db, std::string const& name, int result) {} void CreateCollection(std::string const& db, std::string const& name, int result) {}

1
arangod/Utils/Events.h
View File

@ -42,7 +42,6 @@ void CredentialsMissing(GeneralRequest const&);
void LoggedIn(GeneralRequest const&, std::string const& username); void LoggedIn(GeneralRequest const&, std::string const& username);
void CredentialsBad(GeneralRequest const&, std::string const& username); void CredentialsBad(GeneralRequest const&, std::string const& username);
void CredentialsBad(GeneralRequest const&, rest::AuthenticationMethod); void CredentialsBad(GeneralRequest const&, rest::AuthenticationMethod);
void PasswordChangeRequired(GeneralRequest const&);
void Authenticated(GeneralRequest const&, rest::AuthenticationMethod); void Authenticated(GeneralRequest const&, rest::AuthenticationMethod);
void NotAuthorized(GeneralRequest const&); void NotAuthorized(GeneralRequest const&);
void CreateCollection(std::string const& db, std::string const& name, int result); void CreateCollection(std::string const& db, std::string const& name, int result);

8
js/client/modules/@arangodb/testsuites/audit.js
View File

@ -70,10 +70,16 @@ function auditLog(onServer) {
options.auditLoggingEnabled = true; options.auditLoggingEnabled = true;
const serverOptions = {
'server.authentication': 'true',
'server.jwt-secret': 'haxxmann',
'log.level': 'audit-authentication=info',
};
print(CYAN + 'Audit log server tests...' + RESET); print(CYAN + 'Audit log server tests...' + RESET);
let testCases = tu.scanTestPaths(testPaths['audit_' + (onServer ? 'server' : 'client')]); let testCases = tu.scanTestPaths(testPaths['audit_' + (onServer ? 'server' : 'client')]);
return tu.performTests(options, testCases, 'audit', onServer ? tu.runThere : tu.runInArangosh); return tu.performTests(options, testCases, 'audit', onServer ? tu.runThere : tu.runInArangosh, serverOptions);
}; };
} }

1
js/common/bootstrap/errors.js
View File

@ -239,7 +239,6 @@
"ERROR_USER_INVALID_PASSWORD" : { "code" : 1701, "message" : "invalid password" }, "ERROR_USER_INVALID_PASSWORD" : { "code" : 1701, "message" : "invalid password" },
"ERROR_USER_DUPLICATE" : { "code" : 1702, "message" : "duplicate user" }, "ERROR_USER_DUPLICATE" : { "code" : 1702, "message" : "duplicate user" },
"ERROR_USER_NOT_FOUND" : { "code" : 1703, "message" : "user not found" }, "ERROR_USER_NOT_FOUND" : { "code" : 1703, "message" : "user not found" },
"ERROR_USER_CHANGE_PASSWORD" : { "code" : 1704, "message" : "user must change his password" },
"ERROR_USER_EXTERNAL" : { "code" : 1705, "message" : "user is external" }, "ERROR_USER_EXTERNAL" : { "code" : 1705, "message" : "user is external" },
"ERROR_SERVICE_INVALID_NAME" : { "code" : 1750, "message" : "invalid service name" }, "ERROR_SERVICE_INVALID_NAME" : { "code" : 1750, "message" : "invalid service name" },
"ERROR_SERVICE_INVALID_MOUNT" : { "code" : 1751, "message" : "invalid mount" }, "ERROR_SERVICE_INVALID_MOUNT" : { "code" : 1751, "message" : "invalid mount" },

1
lib/Basics/errors.dat
View File

@ -308,7 +308,6 @@ ERROR_USER_INVALID_NAME,1700,"invalid user name","Will be raised when an invalid
ERROR_USER_INVALID_PASSWORD,1701,"invalid password","Will be raised when an invalid password is used." ERROR_USER_INVALID_PASSWORD,1701,"invalid password","Will be raised when an invalid password is used."
ERROR_USER_DUPLICATE,1702,"duplicate user","Will be raised when a user name already exists." ERROR_USER_DUPLICATE,1702,"duplicate user","Will be raised when a user name already exists."
ERROR_USER_NOT_FOUND,1703,"user not found","Will be raised when a user name is updated that does not exist." ERROR_USER_NOT_FOUND,1703,"user not found","Will be raised when a user name is updated that does not exist."
ERROR_USER_CHANGE_PASSWORD,1704,"user must change his password","Will be raised when the user must change his password."
ERROR_USER_EXTERNAL,1705,"user is external","Will be raised when the user is authenicated by an external server." ERROR_USER_EXTERNAL,1705,"user is external","Will be raised when the user is authenicated by an external server."
############################################################################### ###############################################################################

1
lib/Basics/voc-errors.cpp
View File

@ -238,7 +238,6 @@ void TRI_InitializeErrorMessages() {
REG_ERROR(ERROR_USER_INVALID_PASSWORD, "invalid password"); REG_ERROR(ERROR_USER_INVALID_PASSWORD, "invalid password");
REG_ERROR(ERROR_USER_DUPLICATE, "duplicate user"); REG_ERROR(ERROR_USER_DUPLICATE, "duplicate user");
REG_ERROR(ERROR_USER_NOT_FOUND, "user not found"); REG_ERROR(ERROR_USER_NOT_FOUND, "user not found");
REG_ERROR(ERROR_USER_CHANGE_PASSWORD, "user must change his password");
REG_ERROR(ERROR_USER_EXTERNAL, "user is external"); REG_ERROR(ERROR_USER_EXTERNAL, "user is external");
REG_ERROR(ERROR_SERVICE_INVALID_NAME, "invalid service name"); REG_ERROR(ERROR_SERVICE_INVALID_NAME, "invalid service name");
REG_ERROR(ERROR_SERVICE_INVALID_MOUNT, "invalid mount"); REG_ERROR(ERROR_SERVICE_INVALID_MOUNT, "invalid mount");

5
lib/Basics/voc-errors.h
View File

@ -1276,11 +1276,6 @@ constexpr int TRI_ERROR_USER_DUPLICATE
/// Will be raised when a user name is updated that does not exist. /// Will be raised when a user name is updated that does not exist.
constexpr int TRI_ERROR_USER_NOT_FOUND = 1703; constexpr int TRI_ERROR_USER_NOT_FOUND = 1703;
/// 1704: ERROR_USER_CHANGE_PASSWORD
/// "user must change his password"
/// Will be raised when the user must change his password.
constexpr int TRI_ERROR_USER_CHANGE_PASSWORD = 1704;
/// 1705: ERROR_USER_EXTERNAL /// 1705: ERROR_USER_EXTERNAL
/// "user is external" /// "user is external"
/// Will be raised when the user is authenicated by an external server. /// Will be raised when the user is authenicated by an external server.

1
lib/Logger/LogTopic.cpp
View File

@ -147,6 +147,7 @@ LogTopic Logger::VIEWS("views", LogLevel::FATAL);
LogTopic LdapFeature::LDAP("ldap", LogLevel::INFO); LogTopic LdapFeature::LDAP("ldap", LogLevel::INFO);
LogTopic AuditFeature::AUDIT_AUTHENTICATION("audit-authentication", LogLevel::DEBUG); LogTopic AuditFeature::AUDIT_AUTHENTICATION("audit-authentication", LogLevel::DEBUG);
LogTopic AuditFeature::AUDIT_AUTHORIZATION("audit-authorization", LogLevel::INFO);
LogTopic AuditFeature::AUDIT_DATABASE("audit-database", LogLevel::INFO); LogTopic AuditFeature::AUDIT_DATABASE("audit-database", LogLevel::INFO);
LogTopic AuditFeature::AUDIT_COLLECTION("audit-collection", LogLevel::INFO); LogTopic AuditFeature::AUDIT_COLLECTION("audit-collection", LogLevel::INFO);
LogTopic AuditFeature::AUDIT_VIEW("audit-view", LogLevel::INFO); LogTopic AuditFeature::AUDIT_VIEW("audit-view", LogLevel::INFO);