Keystone notifications don't have enough data

[Kseniya Tychkova]

Keystone currently supports two notification formats: a Basic Notification, and a Cloud Auditing Data Federation (CADF) Notification.
CADF notifications are more informative but it is still not enough.
Here is an example for "deleted.user" event:
{
    "typeURI": "http://schemas.dmtf.org/cloud/audit/1.0/event",
    "initiator": {
        "typeURI": "service/security/account/user",
        "host": {
            "agent": "ceilometer-polling keystoneauth1/2.12.1,
            "address": "172.18.186.212"
        },
        "user_id": "e5ac866ebfce4595a707efd97c342b36",
        "id": "e5ac866ebfce4595a707efd97c342b36"
    },
    "target": {
        "typeURI": "service/security/account/user",
        "id": "f026aee7-20f7-5a7f-965d-300ec50c4686"
    },
    "observer": {
        "typeURI": "service/security",
        "id": "9275459bf1e84ecb8aaaa135b4239bf6"
    },
    "eventType": "activity",
    "eventTime": "2016-09-23T11:46:27.616983+0000",
    "action": "deleted.user",
    "outcome": "success",
    "id": "bdfdb6c5-f8b8-50f5-b161-c9af3e85a852"
}

User is deleted and here is only id of that user.
OpenStack operators will not be able to understand what user exactly was deleted.

[Steve Martinelli (stevemar)]

We have 2 other bugs about this issue: https://bugs.launchpad.net/keystone/+bug/1552795 and https://bugs.launchpad.net/keystone/+bug/1572619

If we're going to make this change, we should *uniformly* include the names of all resources that have names (rather than treat projects as being special): domains, users, roles, groups, etc.

Lance attempted to capture some of the discussion we had on this topic at the summit in Austin: http://lbragstad.com/improving-auditing-in-keystone/

[Steve Martinelli (stevemar)]

There's a patch that is incomplete: https://review.openstack.org/#/c/320299/

[Steve Martinelli (stevemar)]

Another patch that attempted to add names: https://review.openstack.org/#/c/288643/