Role Assignment Notifications¶
In the Juno release, expand on the notifications that are emitted from Keystone by adding support for role assignments.
Suppose a user maliciously decides to grant a role assignment to another user he or she shouldn’t have, or remove another user’s role assignment. As of the Icehouse release, it would only be possible to figure out the responsible party by looking at Keystone logs. If Keystone were to emit notifications for these types of events, auditing would become much easier.
Create a new decorator to emit CADF notifications for
Within the payload of the CADF notification should be the role id, the user id or group id (the actor), and the project id or domain id (the target).
The admin may look at Keystone logs to find the responsible user; however, this could be very hard to do, given the size of the log file.
Create CADF notifications for
delete_grant at the
manager level of the assignment API.
Other End User Impact¶
Other Deployer Impact¶
The audit events generated by the CADF notifications can now be audited.
stevemar (Steve Martinelli <firstname.lastname@example.org>)
create_grantto the manager level. Note that
delete_grantis already exposed at the manager level.
Create a new decorator specific to role assignments.
Enhance the existing documentation to include the expected payload for a role assignment event.