You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hbase.apache.org by zh...@apache.org on 2021/12/04 15:23:55 UTC
[hbase] 01/02: HBASE-26517 Add auth method information to AccessChecker audit log (#3897)
This is an automated email from the ASF dual-hosted git repository.
zhangduo pushed a commit to branch branch-2.4
in repository https://gitbox.apache.org/repos/asf/hbase.git
commit 45347bb81a76c303d91e1012805190b3f1accb2a
Author: Tomu Tsuruhara <to...@gmail.com>
AuthorDate: Sat Dec 4 23:59:29 2021 +0900
HBASE-26517 Add auth method information to AccessChecker audit log (#3897)
Signed-off-by: Duo Zhang <zh...@apache.org>
---
.../apache/hadoop/hbase/security/access/AccessChecker.java | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessChecker.java b/hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessChecker.java
index 7282a1f..15e5e09 100644
--- a/hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessChecker.java
+++ b/hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessChecker.java
@@ -47,6 +47,7 @@ import org.apache.hadoop.hbase.security.access.Permission.Action;
import org.apache.hadoop.hbase.util.Bytes;
import org.apache.hadoop.security.Groups;
import org.apache.hadoop.security.HadoopKerberosName;
+import org.apache.hadoop.security.UserGroupInformation;
import org.apache.yetus.audience.InterfaceAudience;
import org.apache.yetus.audience.InterfaceStability;
import org.slf4j.Logger;
@@ -366,12 +367,16 @@ public class AccessChecker {
public static void logResult(AuthResult result) {
if (AUDITLOG.isTraceEnabled()) {
+ User user = result.getUser();
+ UserGroupInformation ugi = user != null ? user.getUGI() : null;
AUDITLOG.trace(
- "Access {} for user {}; reason: {}; remote address: {}; request: {}; context: {}",
+ "Access {} for user {}; reason: {}; remote address: {}; request: {}; context: {};" +
+ "auth method: {}",
(result.isAllowed() ? "allowed" : "denied"),
- (result.getUser() != null ? result.getUser().getShortName() : "UNKNOWN"),
+ (user != null ? user.getShortName() : "UNKNOWN"),
result.getReason(), RpcServer.getRemoteAddress().map(InetAddress::toString).orElse(""),
- result.getRequest(), result.toContextString());
+ result.getRequest(), result.toContextString(),
+ ugi != null ? ugi.getAuthenticationMethod() : "UNKNOWN");
}
}