Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add additional ignore_headers audit configuration setting #3885

Merged
merged 16 commits into from
Jan 5, 2024

Conversation

stephen-crawford
Copy link
Contributor

@stephen-crawford stephen-crawford commented Dec 21, 2023

Description

This change adds a new setting to the audit.yml configuration allowing users to specify REST headers they wish to be ignored from audit logging.

Issues Resolved

Testing

Added a couple new test cases to check the setting

Check List

  • New functionality includes testing
  • New functionality has been documented
  • Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

stephen-crawford and others added 8 commits December 20, 2023 11:34
Signed-off-by: Stephen Crawford <[email protected]>
Signed-off-by: Stephen Crawford <[email protected]>
Signed-off-by: Stephen Crawford <[email protected]>
Signed-off-by: Stephen Crawford <[email protected]>
Signed-off-by: Stephen Crawford <[email protected]>
Signed-off-by: Stephen Crawford <[email protected]>
Signed-off-by: Stephen Crawford <[email protected]>
Signed-off-by: Stephen Crawford <[email protected]>
Signed-off-by: Stephen Crawford <[email protected]>
cwperks
cwperks previously approved these changes Dec 22, 2023
Copy link
Member

@cwperks cwperks left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! I left one small suggestion around naming the method on the filter.

…ge.java

Co-authored-by: Craig Perkins <[email protected]>
Signed-off-by: Stephen Crawford <[email protected]>
DarshitChanpura
DarshitChanpura previously approved these changes Jan 2, 2024
Copy link
Member

@DarshitChanpura DarshitChanpura left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Left few nits

@DarshitChanpura
Copy link
Member

There is a compilation error:

/home/runner/work/security/security/src/test/java/org/opensearch/security/auditlog/impl/AuditMessageTest.java:79: error: cannot find symbol
        when(auditConfig.getFilter().isHeaderDisabled("test-header")).thenReturn(false);

Signed-off-by: Stephen Crawford <[email protected]>
Copy link

codecov bot commented Jan 2, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (26e62d5) 65.18% compared to head (6d630d1) 65.21%.

Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main    #3885      +/-   ##
==========================================
+ Coverage   65.18%   65.21%   +0.02%     
==========================================
  Files         298      298              
  Lines       21195    21210      +15     
  Branches     3456     3457       +1     
==========================================
+ Hits        13817    13832      +15     
  Misses       5664     5664              
  Partials     1714     1714              
Files Coverage Δ
.../opensearch/security/OpenSearchSecurityPlugin.java 84.53% <100.00%> (+0.09%) ⬆️
...ensearch/security/auditlog/config/AuditConfig.java 99.22% <100.00%> (+0.05%) ⬆️
...earch/security/auditlog/impl/AbstractAuditLog.java 76.20% <ø> (ø)
...pensearch/security/auditlog/impl/AuditMessage.java 75.00% <100.00%> (+0.24%) ⬆️
...g/opensearch/security/support/ConfigConstants.java 95.23% <ø> (ø)

DarshitChanpura
DarshitChanpura previously approved these changes Jan 2, 2024
Signed-off-by: Stephen Crawford <[email protected]>
config/config.yml Outdated Show resolved Hide resolved
config/config.yml Outdated Show resolved Hide resolved
Signed-off-by: Stephen Crawford <[email protected]>
@peternied peternied merged commit 03fd79f into opensearch-project:main Jan 5, 2024
82 checks passed
@peternied peternied deleted the jwtAuditLog branch January 5, 2024 20:00
@peternied peternied added the backport 2.x backport to 2.x branch label Jan 5, 2024
opensearch-trigger-bot bot pushed a commit that referenced this pull request Jan 5, 2024
Signed-off-by: Stephen Crawford <[email protected]>
Signed-off-by: Stephen Crawford <[email protected]>
Co-authored-by: Craig Perkins <[email protected]>
(cherry picked from commit 03fd79f)
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
@peternied
Copy link
Member

@scrawfor99 Do you have a link to the documentation update?

peternied pushed a commit that referenced this pull request Jan 5, 2024
…ing (#3926)

Backport 03fd79f from #3885.

Signed-off-by: Stephen Crawford <[email protected]>
Signed-off-by: Stephen Crawford <[email protected]>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Craig Perkins <[email protected]>
dlin2028 pushed a commit to dlin2028/security that referenced this pull request May 1, 2024
…-project#3885)

Signed-off-by: Stephen Crawford <[email protected]>
Signed-off-by: Stephen Crawford <[email protected]>
Co-authored-by: Craig Perkins <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport 2.x backport to 2.x branch
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Redact custom headers from audit logging
4 participants