Skip to content

Add tenant to audit log (#5709) #6181

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
quangdutran wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add tenant to audit log (#5709) #6181

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9b72486
Add tenant to audit log (#5709)
quangdutran Jun 4, 2026
18e4b72
Merge branch 'main' into main
DarshitChanpura Jun 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 38 additions & 0 deletions src/main/java/org/opensearch/security/auditlog/impl/AbstractAuditLog.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,6 +177,7 @@ public void logFailedLogin(String effectiveUser, boolean securityadmin, String i
msg.addRestRequestInfo(request, auditConfigFilter);
msg.addInitiatingUser(initiatingUser);
msg.addEffectiveUser(effectiveUser);
msg.addTenant(getTenant(request));
msg.addIsAdminDn(securityadmin);

save(msg);
Expand All @@ -195,6 +196,7 @@ public void logSucceededLogin(String effectiveUser, boolean securityadmin, Strin
msg.addRestRequestInfo(request, auditConfigFilter);
msg.addInitiatingUser(initiatingUser);
msg.addEffectiveUser(effectiveUser);
msg.addTenant(getTenant(request));
msg.addIsAdminDn(securityadmin);
save(msg);
}
Expand All @@ -210,6 +212,7 @@ public void logMissingPrivileges(String privilege, String effectiveUser, Securit
msg.addRemoteAddress(remoteAddress);
msg.addRestRequestInfo(request, auditConfigFilter);
msg.addEffectiveUser(effectiveUser);
msg.addTenant(getTenant(request));
msg.addPrivilege(privilege);
save(msg);
}
Expand All @@ -224,6 +227,7 @@ public void logGrantedPrivileges(String effectiveUser, SecurityRequest request)
msg.addRemoteAddress(getRemoteAddress());
msg.addRestRequestInfo(request, auditConfigFilter);
msg.addEffectiveUser(effectiveUser);
msg.addTenant(getTenant(request));
save(msg);
}

Expand All @@ -244,6 +248,7 @@ public void logMissingPrivileges(String privilege, TransportRequest request, Tas
getUser(),
null,
null,
getTenant(),
remoteAddress,
request,
getThreadContextHeaders(),
Expand Down Expand Up @@ -281,6 +286,7 @@ public void logGrantedPrivileges(String privilege, TransportRequest request, Tas
getUser(),
null,
null,
getTenant(),
remoteAddress,
request,
getThreadContextHeaders(),
Expand Down Expand Up @@ -319,6 +325,7 @@ public void logIndexEvent(String privilege, TransportRequest request, Task task)
getUser(),
null,
null,
getTenant(),
remoteAddress,
request,
getThreadContextHeaders(),
Expand Down Expand Up @@ -517,6 +524,7 @@ public void logBadHeaders(TransportRequest request, String action, Task task) {
getUser(),
null,
null,
getTenant(),
remoteAddress,
request,
getThreadContextHeaders(),
Expand Down Expand Up @@ -549,6 +557,7 @@ public void logBadHeaders(SecurityRequest request) {
msg.addRemoteAddress(remoteAddress);
msg.addRestRequestInfo(request, auditConfigFilter);
msg.addEffectiveUser(getUser());
msg.addTenant(getTenant(request));

save(msg);
}
Expand All @@ -569,6 +578,7 @@ public void logSecurityIndexAttempt(TransportRequest request, String action, Tas
getUser(),
false,
null,
getTenant(),
remoteAddress,
request,
getThreadContextHeaders(),
Expand Down Expand Up @@ -606,6 +616,7 @@ public void logSSLException(TransportRequest request, Throwable t, String action
getUser(),
false,
null,
getTenant(),
remoteAddress,
request,
getThreadContextHeaders(),
Expand Down Expand Up @@ -640,6 +651,7 @@ public void logSSLException(SecurityRequest request, Throwable t) {
msg.addRestRequestInfo(request, auditConfigFilter);
msg.addException(t);
msg.addEffectiveUser(getUser());
msg.addTenant(getTenant(request));
save(msg);
}

Expand Down Expand Up @@ -671,6 +683,7 @@ public void logDocumentRead(String index, String id, ShardId shardId, Map<String
TransportAddress remoteAddress = getRemoteAddress();
msg.addRemoteAddress(remoteAddress);
msg.addEffectiveUser(effectiveUser);
msg.addTenant(getTenant());
msg.addIndices(new String[] { index });
msg.addResolvedIndices(new String[] { index });
msg.addShardId(shardId);
Expand Down Expand Up @@ -744,6 +757,7 @@ public void logDocumentWritten(ShardId shardId, GetResult originalResult, Index
TransportAddress remoteAddress = getRemoteAddress();
msg.addRemoteAddress(remoteAddress);
msg.addEffectiveUser(effectiveUser);
msg.addTenant(getTenant());
msg.addIndices(new String[] { shardId.getIndexName() });
msg.addResolvedIndices(new String[] { shardId.getIndexName() });
msg.addId(id);
Expand Down Expand Up @@ -893,6 +907,7 @@ public void logDocumentDeleted(ShardId shardId, Delete delete, DeleteResult resu
TransportAddress remoteAddress = getRemoteAddress();
msg.addRemoteAddress(remoteAddress);
msg.addEffectiveUser(effectiveUser);
msg.addTenant(getTenant());
msg.addIndices(new String[] { shardId.getIndexName() });
msg.addResolvedIndices(new String[] { shardId.getIndexName() });
msg.addId(id);
Expand Down Expand Up @@ -988,6 +1003,7 @@ public void logDocumentDeleted(ShardId shardId, Delete delete, DeleteResult resu
public void logApiTokenCreated(String tokenName, String createdBy) {
AuditMessage msg = new AuditMessage(AuditCategory.API_TOKEN_WRITE, clusterService, getOrigin(), null);
msg.addEffectiveUser(createdBy);
msg.addTenant(getTenant());
msg.addSecurityConfigWriteDiffSource("{\"action\":\"created\",\"token_name\":\"" + tokenName + "\"}", tokenName);
save(msg);
}
Expand All @@ -996,6 +1012,7 @@ public void logApiTokenCreated(String tokenName, String createdBy) {
public void logApiTokenRevoked(String tokenId, String revokedBy) {
AuditMessage msg = new AuditMessage(AuditCategory.API_TOKEN_WRITE, clusterService, getOrigin(), null);
msg.addEffectiveUser(revokedBy);
msg.addTenant(getTenant());
msg.addSecurityConfigWriteDiffSource("{\"action\":\"revoked\",\"token_id\":\"" + tokenId + "\"}", tokenId);
save(msg);
}
Expand Down Expand Up @@ -1083,6 +1100,27 @@ private String getUser() {
return user == null ? null : user.getName();
}

private String getTenant() {
User user = threadPool.getThreadContext().getTransient(ConfigConstants.OPENDISTRO_SECURITY_USER);
if (user == null && threadPool.getThreadContext().getHeader(ConfigConstants.OPENDISTRO_SECURITY_USER_HEADER) != null) {
user = this.userFactory.fromSerializedBase64(
threadPool.getThreadContext().getHeader(ConfigConstants.OPENDISTRO_SECURITY_USER_HEADER)
);
}
return user == null ? null : user.getRequestedTenant();
}

private String getTenant(SecurityRequest request) {
final String fromUser = getTenant();
if (fromUser != null) {
return fromUser;
}
if (request == null) {
return null;
}
return request.header("securitytenant");
}

private Map<String, String> getThreadContextHeaders() {
return threadPool.getThreadContext().getHeaders();
}
Expand Down
7 changes: 7 additions & 0 deletions src/main/java/org/opensearch/security/auditlog/impl/AuditMessage.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,7 @@ public final class AuditMessage {
public static final String CATEGORY = "audit_category";
public static final String REQUEST_EFFECTIVE_USER = "audit_request_effective_user";
public static final String REQUEST_INITIATING_USER = "audit_request_initiating_user";
public static final String REQUEST_TENANT = "audit_request_tenant";
public static final String UTC_TIMESTAMP = "@timestamp";

public static final String CLUSTER_NAME = "audit_cluster_name";
Expand Down Expand Up @@ -200,6 +201,12 @@ public void addEffectiveUser(String user) {
}
}

public void addTenant(String tenant) {
if (tenant != null && !tenant.isEmpty()) {
auditInfo.put(REQUEST_TENANT, tenant);
}
}

public void addPath(String path) {
if (path != null) {
auditInfo.put(REST_REQUEST_PATH, path);
Expand Down
5 changes: 5 additions & 0 deletions src/main/java/org/opensearch/security/auditlog/impl/RequestResolver.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,7 @@ public static List<AuditMessage> resolve(
final String effectiveUser,
final Boolean securityadmin,
final String initiatingUser,
final String tenant,
final TransportAddress remoteAddress,
final TransportRequest request,
final Map<String, String> headers,
Expand All @@ -97,6 +98,7 @@ public static List<AuditMessage> resolve(
effectiveUser,
securityadmin,
initiatingUser,
tenant,
remoteAddress,
action,
privilege,
Expand Down Expand Up @@ -137,6 +139,7 @@ public static List<AuditMessage> resolve(
effectiveUser,
securityadmin,
initiatingUser,
tenant,
remoteAddress,
action,
privilege,
Expand All @@ -161,6 +164,7 @@ private static AuditMessage resolveInner(
final String effectiveUser,
final Boolean securityadmin,
final String initiatingUser,
final String tenant,
final TransportAddress remoteAddress,
final String action,
final String priv,
Expand All @@ -181,6 +185,7 @@ private static AuditMessage resolveInner(
final AuditMessage msg = new AuditMessage(category, cs, origin, Origin.TRANSPORT);
msg.addInitiatingUser(initiatingUser);
msg.addEffectiveUser(effectiveUser);
msg.addTenant(tenant);
msg.addRemoteAddress(remoteAddress);
msg.addAction(action);

Expand Down
45 changes: 45 additions & 0 deletions src/test/java/org/opensearch/security/auditlog/integration/BasicAuditlogTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -982,4 +982,49 @@ public void testSensitiveMethodRedaction() throws Exception {
assertThat(TestAuditlogImpl.messages.size(), is(1));
Assert.assertTrue(TestAuditlogImpl.sb.toString().contains(expectedUpdateUserRequestBody));
}

@Test
public void testTenantFieldOnAuthenticatedRestRequest() throws Exception {
final Settings settings = Settings.builder()
.put("plugins.security.audit.type", TestAuditlogImpl.class.getName())
.put(ConfigConstants.OPENDISTRO_SECURITY_AUDIT_CONFIG_DISABLED_REST_CATEGORIES, "NONE")
.put(ConfigConstants.OPENDISTRO_SECURITY_AUDIT_CONFIG_DISABLED_TRANSPORT_CATEGORIES, "NONE")
.build();
setup(settings);

final List<AuditMessage> messages = TestAuditlogImpl.doThenWaitForMessages(() -> {
final HttpResponse response = rh.executeGetRequest(
"_search",
encodeBasicHeader("admin", "admin"),
new BasicHeader("securitytenant", "engineering_tenant")
);
assertThat(response.getStatusCode(), equalTo(HttpStatus.SC_OK));
}, 2);

messages.forEach(message -> assertThat(message.toJson(), message.getAsMap().get(AuditMessage.REQUEST_TENANT), equalTo("engineering_tenant")));
validateMsgs(messages);
}

@Test
public void testTenantFieldOnFailedLogin() throws Exception {
final Settings settings = Settings.builder()
.put("plugins.security.audit.type", TestAuditlogImpl.class.getName())
.put(ConfigConstants.OPENDISTRO_SECURITY_AUDIT_CONFIG_DISABLED_REST_CATEGORIES, "NONE")
.build();
setup(settings);

final List<AuditMessage> messages = TestAuditlogImpl.doThenWaitForMessages(() -> {
final HttpResponse response = rh.executeGetRequest(
"_search",
encodeBasicHeader("admin", "wrongpassword"),
new BasicHeader("securitytenant", "engineering_tenant")
);
assertThat(response.getStatusCode(), equalTo(HttpStatus.SC_UNAUTHORIZED));
}, 1);

assertThat(messages.get(0).getCategory(), equalTo(AuditCategory.FAILED_LOGIN));
assertThat(messages.get(0).getAsMap().get(AuditMessage.REQUEST_TENANT), equalTo("engineering_tenant"));

validateMsgs(messages);
}
}
Loading