ec2 credentials do not create audit notifications

[Nathan Oyler]

ec2 credentials is not configured to create audit notifications, meaning actions are untracked by the auditing system.

[Colleen Murphy (krinkle)]

Is the issue that there are no notifications when you create/delete them, or when you try to authenticate with them?

[Nathan Oyler (notq)]

No notifications when you create/delete them. I do not have authentication notifications turned on, so cannot validate that portion.

[Colleen Murphy (krinkle)]

Got it. Notifications should be being emitted from here https://opendev.org/openstack/keystone/src/branch/master/keystone/credential/core.py#L115-L132 (for example, the way we do here https://opendev.org/openstack/keystone/src/branch/master/keystone/application_credential/core.py#L150) and it looks like we just don't have them.

[Nathan Oyler (notq)]

Straight forward for create, add notifications import, change signature to include initiator=None and add the notification code as listed.

There is no delete method because it automagically calls the delete in the driver (keystone/credentials/backends/sql.py), best to add the delete function to the manager in core.py so the notification can happen from there

But then do I have to make sure the delete function in the manager is actually called? We're starting to get past my understanding of how things work.

[Nathan Oyler (notq)]

https://review.opendev.org/#/c/664407/

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/664618

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/664618
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=579cc19857048a8710a9f173c602f51a2fcabba1
Submitter: Zuul
Branch: master

commit 579cc19857048a8710a9f173c602f51a2fcabba1
Author: Nathan Oyler <email address hidden>
Date: Mon Jun 10 10:32:05 2019 -0700

    Add cadf auditing to credentials

    added audit logging to credentials.

    Closes-bug: #1831918
    Change-Id: I028a86f44e049bcc7c54e844bfc91aa0b11cd541

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/keystone 16.0.0.0rc1 release candidate.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/stein
Review: https://review.opendev.org/711545

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/rocky
Review: https://review.opendev.org/711547

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/711545
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=e57e44c0ecf4491bba4ed451e6b3016552824ff5
Submitter: Zuul
Branch: stable/stein

commit e57e44c0ecf4491bba4ed451e6b3016552824ff5
Author: Nathan Oyler <email address hidden>
Date: Mon Jun 10 10:32:05 2019 -0700

    Add cadf auditing to credentials

    added audit logging to credentials.

    This backport is a bit different than the original patch,
    since we don't have the adds caching of credentials
    patch find on commit 479a2a0afaeb505c371ee97a1f2fbc1b11e3cef1
    and we were not able to backport it.

    So, there are sense on keep the invalidate cache calls in the
    original bits.

    Closes-bug: #1831918
    Change-Id: I028a86f44e049bcc7c54e844bfc91aa0b11cd541
    (cherry picked from commit 579cc19857048a8710a9f173c602f51a2fcabba1)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/711547
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=abf5cb6a55b78afceade692dceba7542e06736b4
Submitter: Zuul
Branch: stable/rocky

commit abf5cb6a55b78afceade692dceba7542e06736b4
Author: Nathan Oyler <email address hidden>
Date: Mon Jun 10 10:32:05 2019 -0700

    Add cadf auditing to credentials

    added audit logging to credentials.

    This backport is a bit different than the original patch,
    since we don't have the adds caching of credentials
    patch find on commit 479a2a0afaeb505c371ee97a1f2fbc1b11e3cef1
    and we were not able to backport it.

    So, there are sense on keep the invalidate cache calls in the
    original bits.

    Closes-bug: #1831918
    Change-Id: I028a86f44e049bcc7c54e844bfc91aa0b11cd541
    (cherry picked from commit 579cc19857048a8710a9f173c602f51a2fcabba1)

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/queens
Review: https://review.opendev.org/729765

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/keystone rocky-eol release.