Pārlūkot izejas kodu

[core] Add descriptive operationText to the audit log for user/group admin operations

Adds new "operationText" field to audit log that includes corresponding user/group names or IDs:

{"username": "jennykim", "impersonator": "hue", "eventTime": 1444243437834, "operationText": "", "service": "accounts", "url": "/accounts/login/", "allowed": true, "operation": "USER_LOGIN", "ipAddress": "127.0.0.1"}
{"username": "jennykim", "impersonator": "hue", "eventTime": 1444243464043, "operationText": "Created User with username: yoshi", "service": "useradmin", "url": "/useradmin/users/new", "allowed": true, "operation": "CREATE_USER", "ipAddress": "127.0.0.1"}
{"username": "jennykim", "impersonator": "hue", "eventTime": 1444243475043, "operationText": "Edited User with username: yoshi", "service": "useradmin", "url": "/useradmin/users/edit/yoshi", "allowed": true, "operation": "EDIT_USER", "ipAddress": "127.0.0.1"}
{"username": "jennykim", "impersonator": "hue", "eventTime": 1444243489821, "operationText": "Created Group: hue, with member(s): hue, jennykim", "service": "useradmin", "url": "/useradmin/groups/new", "allowed": true, "operation": "CREATE_GROUP", "ipAddress": "127.0.0.1"}
{"username": "jennykim", "impersonator": "hue", "eventTime": 1444243501681, "operationText": "Edited Group: hue, with member(s): hue, jennykim", "service": "useradmin", "url": "/useradmin/groups/edit/hue", "allowed": true, "operation": "EDIT_GROUP", "ipAddress": "127.0.0.1"}
{"username": "jennykim", "impersonator": "hue", "eventTime": 1444243507026, "operationText": "Deleted Group(s): hue", "service": "useradmin", "url": "/useradmin/groups/delete", "allowed": true, "operation": "DELETE_GROUP", "ipAddress": "127.0.0.1"}
{"username": "jennykim", "impersonator": "hue", "eventTime": 1444243531166, "operationText": "", "service": "accounts", "url": "/accounts/login/", "allowed": true, "operation": "USER_LOGIN", "ipAddress": "127.0.0.1"}
{"username": "jennykim", "impersonator": "hue", "eventTime": 1444243539505, "operationText": "Added/Synced LDAP username(s): cconner", "service": "useradmin", "url": "/useradmin/users/add_ldap_users", "allowed": true, "operation": "ADD_LDAP_USERS", "ipAddress": "127.0.0.1"}
{"username": "jennykim", "impersonator": "hue", "eventTime": 1444243550296, "operationText": "Added LDAP Group(s): admins", "service": "useradmin", "url": "/useradmin/users/add_ldap_groups", "allowed": true, "operation": "ADD_LDAP_GROUPS", "ipAddress": "127.0.0.1"}
{"username": "jennykim", "impersonator": "hue", "eventTime": 1444243561598, "operationText": "", "service": "useradmin", "url": "/useradmin/users/sync_ldap_users_groups", "allowed": true, "operation": "SYNC_LDAP_USERS_GROUPS", "ipAddress": "127.0.0.1"}
Jenny Kim 10 gadi atpakaļ
vecāks
revīzija
a9f4b2f144
1 mainītis faili ar 30 papildinājumiem un 3 dzēšanām
  1. 30 3
      desktop/core/src/desktop/middleware.py

+ 30 - 3
desktop/core/src/desktop/middleware.py

@@ -27,12 +27,11 @@ import time
 
 import kerberos
 
-from datetime import datetime
-
 from django.conf import settings
 from django.contrib import messages
 from django.contrib.auth import REDIRECT_FIELD_NAME, BACKEND_SESSION_KEY, authenticate, load_backend, login
 from django.contrib.auth.middleware import RemoteUserMiddleware
+from django.contrib.auth.models import User
 from django.core import exceptions, urlresolvers
 import django.db
 from django.http import HttpResponseNotAllowed
@@ -40,7 +39,6 @@ from django.core.urlresolvers import resolve
 from django.http import HttpResponseRedirect, HttpResponse
 from django.utils.translation import ugettext as _
 from django.utils.http import urlquote, is_safe_url
-from django.utils.encoding import iri_to_uri
 import django.views.static
 
 import desktop.views
@@ -401,6 +399,7 @@ class AuditLoggingMiddleware(object):
       'impersonator': self.impersonator,
       'ipAddress': self._get_client_ip(request),
       'operation': operation,
+      'operationText': self._get_operation_text(operation, request),
       'eventTime': self._milliseconds_since_epoch(),
       'allowed': self._get_allowed(operation, request, response),
       'service': get_app_name(request),
@@ -451,6 +450,34 @@ class AuditLoggingMiddleware(object):
 
     return None
 
+  def _get_operation_text(self, operation, request):
+    if request.method == 'POST':
+      if operation == 'CREATE_USER':
+        return 'Created User with username: %s' % request.POST.get('username', '')
+      elif operation == 'EDIT_USER':
+        return 'Edited User with username: %s' % request.POST.get('username', '')
+      elif operation == 'DELETE_USER':
+        usernames = self._get_usernames(request.POST.getlist('user_ids', []))
+        return 'Deleted User ID(s): %s' % ', '.join(usernames)
+      elif operation == 'ADD_LDAP_USERS':
+        return 'Added/Synced LDAP username(s): %s' % ', '.join(request.POST.getlist('username_pattern', []))
+      elif operation == 'CREATE_GROUP':
+        usernames = self._get_usernames(request.POST.getlist('members', []))
+        return 'Created Group: %s, with member(s): %s' % (request.POST.get('name', ''), ', '.join(usernames))
+      elif operation == 'EDIT_GROUP':
+        usernames = self._get_usernames(request.POST.getlist('members', []))
+        return 'Edited Group: %s, with member(s): %s' % (request.POST.get('name', ''), ', '.join(usernames))
+      elif operation == 'DELETE_GROUP':
+        return 'Deleted Group(s): %s' % ', '.join(request.POST.getlist('group_names', []))
+      elif operation == 'ADD_LDAP_GROUPS':
+        return 'Added LDAP Group(s): %s' % ', '.join(request.POST.getlist('groupname_pattern', []))
+
+    return ''
+
+  def _get_usernames(self, user_ids):
+    return User.objects.filter(pk__in=user_ids).values_list('username', flat=True)
+
+
 try:
   import tidylib
   _has_tidylib = True