roryqi opened a new issue, #12885:
URL: https://github.com/apache/gravitino/issues/12885
### Version
main branch
### Describe what's wrong
Audit entries for granting and revoking roles identify the affected user or
group, but do not record the roles that were granted or revoked.
As a result, two assignments involving different roles produce
indistinguishable audit entries apart from the timestamp. An access review
cannot reconstruct which permissions were changed.
The following operations are affected:
- `GRANT_USER_ROLES`
- `REVOKE_USER_ROLES`
- `GRANT_GROUP_ROLES`
- `REVOKE_GROUP_ROLES`
Both successful and failed operations omit the role names.
### Error message and/or stacktrace
No exception is required to reproduce the issue. The generated audit entry
does not contain the `roleNames` field from the request.
### How to reproduce
1. Enable audit logging.
2. Grant a named role to a user:
`PUT /api/metalakes/{metalake}/permissions/users/{user}/grant`
Request body:
`{"roleNames":["reader"]}`
3. Inspect the generated `GRANT_USER_ROLES` audit entry.
4. Observe that it identifies the user but does not contain `reader`.
5. Repeat for user revoke and the equivalent group operations.
### Additional context
Role assignment operations change what a principal can access. An audit
entry should identify both the principal and the affected roles.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
