Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adjust logging levels for LDAP failures #76477

Conversation

tvernum
Copy link
Contributor

@tvernum tvernum commented Aug 13, 2021

This change increases the logging level for LDAP failures in 3 cases:

  1. When a search fails, the failure details are now logged at DEBUG
    rather than TRACE. The errors are useful for diagnostic purposes and
    it should not be necessary to turn on TRACE to see them

  2. When a failure occurs when attempting to bind using the configured
    "bind_dn" and password, this is now a WARN rather than DEBUG. Failures
    for user supplied credentials (e.g. basic auth) are still logged as
    DEBUG because these are typically not under the control of the cluster
    administrator.

  3. When a failure occurs while attempting to retrieve a connection
    from an LDAP connection pool, this will be logged at a WARN level.
    This is almost always an error that the cluster administrator should
    be aware of and seek to resolve.

In some cases this may cause 2 sets of log messages (one from LDAP and
one from the authentication service) however it is not always the case
that both are logged, and even when they are they may have different
levels of detail (for example, the authentication service message does
not always include the DN of the bind user).

Backport of: #76058

This change increases the logging level for LDAP failures in 3 cases:

1. When a search fails, the failure details are now logged at DEBUG
rather than TRACE. The errors are useful for diagnostic purposes and
it should not be necessary to turn on TRACE to see them

2. When a failure occurs when attempting to bind using the configured
"bind_dn" and password, this is now a WARN rather than DEBUG. Failures
for user supplied credentials (e.g. basic auth) are still logged as
DEBUG because these are typically not under the control of the cluster
administrator.

3. When a failure occurs while attempting to retrieve a connection
from an LDAP connection pool, this will be logged at a WARN level.
This is almost always an error that the cluster administrator should
be aware of and seek to resolve.

In some cases this may cause 2 sets of log messages (one from LDAP and
one from the authentication service) however it is not always the case
that both are logged, and even when they are they may have different
levels of detail (for example, the authentication service message does
not always include the DN of the bind user).

Backport of: elastic#76058
@tvernum tvernum added backport auto-merge-without-approval Automatically merge pull request when CI checks pass (NB doesn't wait for reviews!) labels Aug 13, 2021
@elasticsearchmachine elasticsearchmachine merged commit 6a6706f into elastic:7.x Aug 13, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
auto-merge-without-approval Automatically merge pull request when CI checks pass (NB doesn't wait for reviews!) backport v7.15.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants