freeipa

#9589 add systemd journal audit of executed API commands
Closed: fixed by rcritten. Opened by abbra.

Closed: fixed
Reopen Issue

For each executed command in server context, send the information about the command to the systemd journal. The resulting string is similar to what is recorded in httpd's error_log for API requests coming through the RPC layer.

In server mode operations are performed directly on the server over LDAPI unix domain socket, so httpd end-point is not used and therefore operations aren't recorded in the error_log. httpd end-point internally also uses the server context, thus all externally performed IPA API requests would also be recorded in the system journal.

PR: https://github.com/freeipa/freeipa/pull/7335

Moved API audit into a separate PR: https://github.com/freeipa/freeipa/pull/7348

master:

  • fd0f432fec692a2db25c270b2e69b3f423ba7f4a ipalib: move json formatter to a separate file
  • 145e33174d99e4826d388b4796ecadb73698cf47 ipalib/rpc: Reformat after moving json code around
  • 84eed2a67fb515f4d5d0af3479c077bf5b788d56 frontend: add systemd journal audit of executed API commands

ipa-4-11:

  • 394fcf9bec8ce1df1c2187dab18283d940a79132 ipalib: move json formatter to a separate file
  • 6b30133d8afa811a9e6f709008acc162498d02ec ipalib/rpc: Reformat after moving json code around
  • 2e75f569903a8b029ab468657f70e4802002f844 frontend: add systemd journal audit of executed API commands

ipa-4-10:

  • 1c86ef42e40c5b7380f03065a63810d6647b7c9a ipalib: move json formatter to a separate file
  • c0bcca0a26e696407499ae08edde8d01e8c5d34c ipalib/rpc: Reformat after moving json code around
  • 378320d97c3413802ba05156568ade906355efc0 frontend: add systemd journal audit of executed API commands
  • 568d422d0a2038c3082d9e887ca73eb6d29264cb tox: allow systemd-python in tox environment
  • 5f5c6542882752daf253b2aa2630c5a2a56fd6e9 Force python 3.11 in tox environments

ipa-4-9:

  • b6a5767b2f37076304859b26ccb2e90e36c24052 ipalib: move json formatter to a separate file
  • 1c72ab660277f478774a0800392b37c2106c54dc ipalib/rpc: Reformat after moving json code around
  • 025f446875fef64989aea229db5700202ddf9661 frontend: add systemd journal audit of executed API commands
  • 401987ec0d09247a47f68b7fc2dcfb57274d4383 Tox: use sitepackages
  • 0e96d9f6e4b1a40bc7386c76bbec72a289bc21d3 tox: allow systemd-python in tox environment
  • ea93ef9a087ce0a504382e3689e5ee9f1809c082 Force python 3.10 in tox environments

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @abbra:
- Custom field changelog adjusted to FreeIPA now audits all IPA API calls through systemd journal on IPA servers. For details please see design page https://freeipa.readthedocs.io/en/latest/designs/audit-ipa-api.html
Metadata
None
None
None
None
FreeIPA now audits all IPA API calls through systemd journal on IPA servers. For details please see design page https://freeipa.readthedocs.io/en/latest/designs/audit-ipa-api.html
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.