mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-01-05 13:07:14 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

refactor to move audit event message types to their own pkg

Browse Source
This commit is contained in:
Ryan Richard
2024-11-07 14:15:04 -08:00
committed by Joshua Casey
parent 088556193d
commit 8cf9c59957
13 changed files with 102 additions and 92 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
internal/federationdomain/endpoints/token/token_handler.go
View File

@@ -19,6 +19,7 @@ import (
"k8s.io/apiserver/pkg/warning"
oidcapi "go.pinniped.dev/generated/latest/apis/supervisor/oidc"
"go.pinniped.dev/internal/auditevent"
"go.pinniped.dev/internal/federationdomain/federationdomainproviders"
"go.pinniped.dev/internal/federationdomain/idtokenlifespan"
"go.pinniped.dev/internal/federationdomain/oidc"
@@ -191,7 +192,7 @@ func upstreamRefresh(
return err
}
auditLogger.Audit(plog.AuditEventIdentityRefreshedFromUpstreamIDP, ctx, accessRequest,
auditLogger.Audit(auditevent.IdentityRefreshedFromUpstreamIDP, ctx, accessRequest,
"upstreamUsername", refreshedIdentity.UpstreamUsername,
"upstreamGroups", refreshedIdentity.UpstreamGroups)
@@ -220,7 +221,7 @@ func upstreamRefresh(
if fositeErr != nil {
// The HintField is always populated by applyIdentityTransformationsDuringRefresh,
// and more descriptive than fositeErr.Error() which is just "error".
auditLogger.Audit(plog.AuditEventAuthenticationRejectedByTransforms, ctx, accessRequest,
auditLogger.Audit(auditevent.AuthenticationRejectedByTransforms, ctx, accessRequest,
"reason", fositeErr.HintField)
return fositeErr
}
@@ -238,7 +239,7 @@ func upstreamRefresh(
session.Fosite.Claims.Extra[oidcapi.IDTokenClaimGroups] = refreshedTransformedGroups
}
auditLogger.Audit(plog.AuditEventSessionRefreshed, ctx, accessRequest,
auditLogger.Audit(auditevent.SessionRefreshed, ctx, accessRequest,
"username", oldTransformedUsername, // not allowed to change above so must be the same as old
"groups", refreshedTransformedGroups,
"subject", previousIdentity.DownstreamSubject)