Add log messages #334
Add log messages #334
Conversation
To 1. allow the user/admin to figure out why authentication is denied, and 2. log failed login attempts, which is security critical (security logging failure is in the OWASP top 10, see https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures).
To have more complete logs of failed login attempts.
Print the IsAuthenticated result for debugging.
| @@ -634,6 +634,7 @@ func (b *Broker) handleIsAuthenticated(ctx context.Context, session *session, au | |||
| } | |||
|
|
|||
| if !b.userNameIsAllowed(authInfo.UserInfo.Name) { | |||
| log.Errorf(context.Background(), "User %q is not in the list of allowed users", authInfo.UserInfo.Name) | |||
There was a problem hiding this comment.
This is the only one that I'm unsure about... As IIRC we didn't want to give much information (neither in log form) whether someone was or not managed by the broker.
But I feel that's not a too big issue, given that normally users don't have access to the journal... That said, I'd leave the decision to @didrocks.
There was a problem hiding this comment.
As I mentioned in the commit message, it's considered a security risk to not log failed login attempts:
To 1. allow the user/admin to figure out why authentication is denied,
and 2. log failed login attempts, which is security critical (security
logging failure is in the OWASP top 10, see
https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures).
Adds some log messages, see commit messages for details.