Vyom Mani Tiwari created RANGER-5870:
----------------------------------------
Summary: Audit: record the constraints returned with an allowed
access decision
Key: RANGER-5870
URL: https://issues.apache.org/jira/browse/RANGER-5870
Project: Ranger
Issue Type: Improvement
Components: admin, audit, plugins
Reporter: Vyom Mani Tiwari
Assignee: Vyom Mani Tiwari
With RANGER-5842 the policy engine returns applicable constraints (for example
{{{}requireApproval{}}}, {{{}search-filter{}}}) along with an allowed decision,
and the caller must enforce them. The access audit doesn’t record them today,
so there’s no trace of which constraints applied to an access or which policy
they came from. That trace is needed for HITL approval flows, for example to
see which actions needed approval and who the approver was.
*Proposal*
# *Audit event:* add {{constraints}} to {{{}AuthzAuditEvent{}}}. It’s a list
with one entry per constraint returned in the access result: constraint name,
policy id, policy version, and parameters, as a JSON string per entry, the same
approach as {{{}tags{}}}.
** Filled in by {{RangerDefaultAuditHandler}} from
{{{}RangerAccessResult.getConstraints(){}}}.
** Empty for denied access and for results without constraints. Existing
audits are unchanged.
# *Audit destinations:* write the field in the Solr, Elasticsearch and
OpenSearch destinations, and add a {{constraints}} field to the Solr audit
schemas (multi-valued string, stored).
# *Admin:* return {{constraints}} in access audit search results
({{{}VXAccessAudit{}}} and the Solr, Elasticsearch, OpenSearch and CloudWatch
audit services), so the audit UI can show it. The UI change itself is a
separate Jira.
*Notes*
* The audit records what Ranger returned (access allowed, subject to these
constraints). Whether the caller then enforced the constraint, for example
approved or rejected the request, is up to the caller’s own audit.
* Constraint parameters can be large, for example a filter expression. Each
entry is limited to the constraint’s own parameters.
* Audit summarization ({{{}getEventKey{}}}) is unchanged.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
