From 655a7f205d9d13ad3f5e4eac0c078aa100bb11cf Mon Sep 17 00:00:00 2001 From: James Read Date: Thu, 14 Nov 2024 22:00:08 +0000 Subject: [PATCH] feature: Improved auth log messages (#476) --- OliveTin.proto | 6 ++++++ internal/acl/acl.go | 10 +++++----- internal/grpcapi/grpcApi.go | 20 +++++++++++++++++++- internal/grpcapi/local_user_login.go | 10 ++++++++++ internal/httpservers/restapi_auth_local.go | 5 ++++- internal/httpservers/restapi_auth_oauth2.go | 6 +++++- 6 files changed, 49 insertions(+), 8 deletions(-) diff --git a/OliveTin.proto b/OliveTin.proto index 9554cc8..0444837 100644 --- a/OliveTin.proto +++ b/OliveTin.proto @@ -155,6 +155,12 @@ message WhoAmIRequest {} message WhoAmIResponse { string authenticated_user = 1; + string usergroup = 2; + string provider = 3; + + repeated string acls = 4; + + string sid = 5; } message SosReportRequest {} diff --git a/internal/acl/acl.go b/internal/acl/acl.go index b7ac489..1a41b93 100644 --- a/internal/acl/acl.go +++ b/internal/acl/acl.go @@ -30,7 +30,7 @@ type AuthenticatedUser struct { Provider string SID string - acls []string + Acls []string } func (u *AuthenticatedUser) IsGuest() bool { @@ -166,7 +166,7 @@ func UserFromContext(ctx context.Context, cfg *config.Config) *AuthenticatedUser "username": ret.Username, "usergroup": ret.Usergroup, "provider": ret.Provider, - "acls": ret.acls, + "acls": ret.Acls, }).Debugf("UserFromContext") return ret @@ -198,12 +198,12 @@ func UserFromSystem(cfg *config.Config, username string) *AuthenticatedUser { func buildUserAcls(cfg *config.Config, user *AuthenticatedUser) { for _, acl := range cfg.AccessControlLists { if slices.Contains(acl.MatchUsernames, user.Username) { - user.acls = append(user.acls, acl.Name) + user.Acls = append(user.Acls, acl.Name) continue } if slices.Contains(acl.MatchUsergroups, user.Usergroup) { - user.acls = append(user.acls, acl.Name) + user.Acls = append(user.Acls, acl.Name) continue } @@ -211,7 +211,7 @@ func buildUserAcls(cfg *config.Config, user *AuthenticatedUser) { } func isACLRelevantToAction(cfg *config.Config, actionAcls []string, acl *config.AccessControlList, user *AuthenticatedUser) bool { - if !slices.Contains(user.acls, acl.Name) { + if !slices.Contains(user.Acls, acl.Name) { // If the user does not have this ACL, then it is not relevant return false diff --git a/internal/grpcapi/grpcApi.go b/internal/grpcapi/grpcApi.go index 1b23549..9668d59 100644 --- a/internal/grpcapi/grpcApi.go +++ b/internal/grpcapi/grpcApi.go @@ -116,6 +116,14 @@ func (api *oliveTinAPI) LocalUserLogin(ctx ctx.Context, req *pb.LocalUserLoginRe if match { header := metadata.Pairs("set-user", req.Username) grpc.SendHeader(ctx, header) + + log.WithFields(log.Fields{ + "username": req.Username, + }).Info("LocalUserLogin: User logged in successfully.") + } else { + log.WithFields(log.Fields{ + "username": req.Username, + }).Warn("LocalUserLogin: User login failed.") } return &pb.LocalUserLoginResponse{ @@ -303,7 +311,13 @@ func (api *oliveTinAPI) GetDashboardComponents(ctx ctx.Context, req *pb.GetDashb res := buildDashboardResponse(api.executor, cfg, user) if len(res.Actions) == 0 { - log.Warn("Zero actions found - check that you have some actions defined, with a view permission") + log.WithFields(log.Fields{ + "username": user.Username, + "usergroup": user.Usergroup, + "provider": user.Provider, + "acls": user.Acls, + "availableActions": len(cfg.Actions), + }).Warn("Zero actions found for user") } log.Tracef("GetDashboardComponents: %v", res) @@ -364,6 +378,10 @@ func (api *oliveTinAPI) WhoAmI(ctx ctx.Context, req *pb.WhoAmIRequest) (*pb.WhoA res := &pb.WhoAmIResponse{ AuthenticatedUser: user.Username, + Usergroup: user.Usergroup, + Provider: user.Provider, + Sid: user.SID, + Acls: user.Acls, } log.Warnf("usergroup: %v", user.Usergroup) diff --git a/internal/grpcapi/local_user_login.go b/internal/grpcapi/local_user_login.go index 139aa92..577481b 100644 --- a/internal/grpcapi/local_user_login.go +++ b/internal/grpcapi/local_user_login.go @@ -44,9 +44,19 @@ func checkUserPassword(cfg *config.Config, username, password string) bool { if match { return true + } else { + log.WithFields(log.Fields{ + "username": username, + }).Warn("Password does not match for user") + + return false } } } + log.WithFields(log.Fields{ + "username": username, + }).Warn("Failed to check password for user, as username was not found") + return false } diff --git a/internal/httpservers/restapi_auth_local.go b/internal/httpservers/restapi_auth_local.go index b09fead..f597541 100644 --- a/internal/httpservers/restapi_auth_local.go +++ b/internal/httpservers/restapi_auth_local.go @@ -24,7 +24,10 @@ func parseLocalUserCookie(req *http.Request) (string, string, string) { username, ok := localUserSessions[cookieValue] if !ok { - log.Warnf("Could not find local user session: %v", cookieValue) + log.WithFields(log.Fields{ + "sid": cookieValue, + "provider": "local", + }).Warnf("Stale session") return "", "", "" } diff --git a/internal/httpservers/restapi_auth_oauth2.go b/internal/httpservers/restapi_auth_oauth2.go index 8b7d89c..b81c3e9 100644 --- a/internal/httpservers/restapi_auth_oauth2.go +++ b/internal/httpservers/restapi_auth_oauth2.go @@ -261,7 +261,11 @@ func parseOAuth2Cookie(r *http.Request) (string, string, string) { serverState, found := registeredStates[cookie.Value] if !found { - log.Warnf("Failed to find OAuth2 state: %v", cookie.Value) + log.WithFields(log.Fields{ + "sid": cookie.Value, + "provider": "oauth2", + }).Warnf("Stale session") + return "", "", cookie.Value }