Audit middleware

The Keystone middleware library provides an optional WSGI middleware filter which allows the ability to audit API requests for each component of OpenStack.

The audit middleware filter utilises environment variables to build the CADF event.

The figure above shows the middleware in Nova’s pipeline.

Enabling audit middleware

To enable auditing, oslo.messaging should be installed. If not, the middleware will log the audit event instead. Auditing can be enabled for a specific project by editing the project’s api-paste.ini file to include the following filter definition:

[filter:audit]
paste.filter_factory = keystonemiddleware.audit:AuditMiddleware.factory
audit_map_file = /etc/nova/api_audit_map.conf

The filter should be included after Keystone middleware’s auth_token middleware so it can utilise environment variables set by auth_token. Below is an example using Nova’s WSGI pipeline:

[composite:openstack_compute_api_v2]
use = call:nova.api.auth:pipeline_factory
noauth = faultwrap sizelimit noauth ratelimit osapi_compute_app_v2
keystone = faultwrap sizelimit authtoken keystonecontext ratelimit audit osapi_compute_app_v2
keystone_nolimit = faultwrap sizelimit authtoken keystonecontext audit osapi_compute_app_v2

Configure audit middleware

To properly audit api requests, the audit middleware requires an api_audit_map.conf to be defined. The project’s corresponding api_audit_map.conf file is included in the pyCADF library.

The location of the mapping file should be specified explicitly by adding the path to the ‘audit_map_file’ option of the filter definition:

[filter:audit]
paste.filter_factory = keystonemiddleware.audit:AuditMiddleware.factory
audit_map_file = /etc/nova/api_audit_map.conf

Additional options can be set:

[filter:audit]
paste.filter_factory = pycadf.middleware.audit:AuditMiddleware.factory
audit_map_file = /etc/nova/api_audit_map.conf
service_name = test # opt to set HTTP_X_SERVICE_NAME environ variable
ignore_req_list = GET,POST # opt to ignore specific requests