Skip to content

Record user role modification audit logs #18361

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
zerolbsony wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Record user role modification audit logs #18361

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0ac751f
Record user role modification audit logs
zerolbsony Jul 30, 2026
9c4fa2d
Avoid auditing redirected role modifications
zerolbsony Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions iotdb-core/datanode/src/main/i18n/en/org/apache/iotdb/db/i18n/DataNodeMiscMessages.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,6 +121,8 @@ public final class DataNodeMiscMessages {

public static final String CREATE_NEW_REGION_ERROR_FMT = "create new region %s error, exception:%s";
public static final String CREATE_NEW_REGION_SUCCEED_FMT = "create new region %s succeed";
public static final String LOG_USER_ARG_ROLE_ARG_422D48D3 = "user: %s, role: %s";

private DataNodeMiscMessages() {}

// ---------------------------------------------------------------------------
Expand Down
2 changes: 2 additions & 0 deletions iotdb-core/datanode/src/main/i18n/zh/org/apache/iotdb/db/i18n/DataNodeMiscMessages.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,6 +121,8 @@ public final class DataNodeMiscMessages {

public static final String CREATE_NEW_REGION_ERROR_FMT = "创建新 region %s 错误，异常：%s";
public static final String CREATE_NEW_REGION_SUCCEED_FMT = "创建新 region %s 成功";
public static final String LOG_USER_ARG_ROLE_ARG_422D48D3 = "用户：%s，角色：%s";

private DataNodeMiscMessages() {}

// ---------------------------------------------------------------------------
Expand Down
125 changes: 125 additions & 0 deletions iotdb-core/datanode/src/main/java/org/apache/iotdb/db/audit/DNAuditLogger.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@
import org.apache.iotdb.commons.path.PartialPath;
import org.apache.iotdb.commons.queryengine.common.SessionInfo;
import org.apache.iotdb.commons.utils.CommonDateTimeUtils;
import org.apache.iotdb.db.i18n.DataNodeMiscMessages;
import org.apache.iotdb.db.queryengine.plan.Coordinator;
import org.apache.iotdb.db.queryengine.plan.relational.sql.ast.RelationalAuthorStatement;
import org.apache.iotdb.db.queryengine.plan.relational.type.AuthorRType;
Expand Down Expand Up @@ -213,6 +214,30 @@ public void logRevokeFailure(
status);
}

public void logUserRoleModificationAuthorizationFailure(
Statement statement, IAuditEntity auditEntity, @Nullable TSStatus status) {
if (isSuccessful(status)) {
return;
}
logUserRoleModification(getUserRoleTarget(statement), auditEntity, status);
}

public void logUserRoleModification(
Statement statement,
SessionInfo sessionInfo,
@Nullable String sql,
@Nullable TSStatus status) {
logUserRoleModification(getUserRoleTarget(statement), sessionInfo, sql, status);
}

public void logUserRoleModification(
org.apache.iotdb.commons.queryengine.plan.relational.sql.ast.Statement statement,
SessionInfo sessionInfo,
@Nullable String sql,
@Nullable TSStatus status) {
logUserRoleModification(getUserRoleTarget(statement), sessionInfo, sql, status);
}

public void logRevokeFailure(
Statement statement,
SessionInfo sessionInfo,
Expand Down Expand Up @@ -272,6 +297,68 @@ private void logRevokeFailure(
() -> targetName);
}

private void logUserRoleModification(
@Nullable UserRoleTarget target,
@Nullable SessionInfo sessionInfo,
@Nullable String sql,
@Nullable TSStatus status) {
if (target == null || sessionInfo == null) {
return;
}
logUserRoleModification(
target,
sessionInfo.getUserId(),
sessionInfo.getUserName(),
sessionInfo.getCliHostname(),
sessionInfo.getDatabaseName().orElse(null),
sql,
status);
}

private void logUserRoleModification(
@Nullable UserRoleTarget target, IAuditEntity auditEntity, @Nullable TSStatus status) {
if (target == null) {
return;
}
logUserRoleModification(
target,
auditEntity.getUserId(),
auditEntity.getUsername(),
auditEntity.getCliHostname(),
auditEntity.getDatabase(),
auditEntity.getSqlString(),
status);
}

private void logUserRoleModification(
UserRoleTarget target,
long userId,
String username,
String clientAddress,
@Nullable String database,
@Nullable String sql,
@Nullable TSStatus status) {
if (status != null && status.getCode() == TSStatusCode.REDIRECTION_RECOMMEND.getStatusCode()) {
return;
}
log(
new AuditLogFields(
userId,
username,
clientAddress,
AuditEventType.MODIFY_USER_ROLE,
AuditLogOperation.CONTROL,
PrivilegeType.SECURITY,
isSuccessful(status),
database,
sql),
() ->
String.format(
DataNodeMiscMessages.LOG_USER_ARG_ROLE_ARG_422D48D3,
target.username,
target.roleName));
}

@Nullable
private static String getTargetName(Statement statement) {
if (!(statement instanceof AuthorStatement)) {
Expand Down Expand Up @@ -314,12 +401,50 @@ private static String getTargetName(
return null;
}

@Nullable
private static UserRoleTarget getUserRoleTarget(Statement statement) {
if (!(statement instanceof AuthorStatement)) {
return null;
}
AuthorStatement authorStatement = (AuthorStatement) statement;
if (authorStatement.getAuthorType() != AuthorType.GRANT_USER_ROLE
&& authorStatement.getAuthorType() != AuthorType.REVOKE_USER_ROLE) {
return null;
}
return new UserRoleTarget(authorStatement.getUserName(), authorStatement.getRoleName());
}

@Nullable
private static UserRoleTarget getUserRoleTarget(
org.apache.iotdb.commons.queryengine.plan.relational.sql.ast.Statement statement) {
if (!(statement instanceof RelationalAuthorStatement)) {
return null;
}
RelationalAuthorStatement authorStatement = (RelationalAuthorStatement) statement;
if (authorStatement.getAuthorType() != AuthorRType.GRANT_USER_ROLE
&& authorStatement.getAuthorType() != AuthorRType.REVOKE_USER_ROLE) {
return null;
}
return new UserRoleTarget(authorStatement.getUserName(), authorStatement.getRoleName());
}

private static boolean isSuccessful(@Nullable TSStatus status) {
return status != null
&& (status.getCode() == TSStatusCode.SUCCESS_STATUS.getStatusCode()
|| status.getCode() == TSStatusCode.REDIRECTION_RECOMMEND.getStatusCode());
}

private static class UserRoleTarget {

private final String username;
private final String roleName;

private UserRoleTarget(String username, String roleName) {
this.username = username;
this.roleName = roleName;
}
}

private static class DNAuditLoggerHolder {

private static final DNAuditLogger INSTANCE = new DNAuditLogger();
Expand Down
4 changes: 3 additions & 1 deletion iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/AuthorityChecker.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -214,7 +214,9 @@ public static TSStatus checkAuthority(Statement statement, IAuditEntity auditEnt
return status;
} finally {
PERFORMANCE_OVERVIEW_METRICS.recordAuthCost(System.nanoTime() - startTime);
DNAuditLogger.getInstance().logRevokeFailure(statement, auditEntity, status);
DNAuditLogger auditLogger = DNAuditLogger.getInstance();
auditLogger.logRevokeFailure(statement, auditEntity, status);
auditLogger.logUserRoleModificationAuthorizationFailure(statement, auditEntity, status);
}
}

Expand Down
13 changes: 9 additions & 4 deletions iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/Coordinator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@
package org.apache.iotdb.db.queryengine.plan;

import org.apache.iotdb.common.rpc.thrift.TEndPoint;
import org.apache.iotdb.common.rpc.thrift.TSStatus;
import org.apache.iotdb.commons.client.ClientPoolFactory;
import org.apache.iotdb.commons.client.IClientManager;
import org.apache.iotdb.commons.client.async.AsyncDataNodeInternalServiceClient;
Expand Down Expand Up @@ -413,8 +414,10 @@ public ExecutionResult executeForTreeModel(
startTime)));
return result;
} finally {
DNAuditLogger.getInstance()
.logRevokeFailure(statement, session, sql, result == null ? null : result.status);
DNAuditLogger auditLogger = DNAuditLogger.getInstance();
TSStatus status = result == null ? null : result.status;
auditLogger.logRevokeFailure(statement, session, sql, status);
auditLogger.logUserRoleModification(statement, session, sql, status);
}
}

Expand Down Expand Up @@ -561,8 +564,10 @@ public ExecutionResult executeForTableModel(
startTime)));
return result;
} finally {
DNAuditLogger.getInstance()
.logRevokeFailure(statement, session, sql, result == null ? null : result.status);
DNAuditLogger auditLogger = DNAuditLogger.getInstance();
TSStatus status = result == null ? null : result.status;
auditLogger.logRevokeFailure(statement, session, sql, status);
auditLogger.logUserRoleModification(statement, session, sql, status);
}
}

Expand Down
Loading