gRPC-C++: Logging policy based Authorization failures

[Rameshreddy Mudhireddy]

Hi Dev team,

Is there a way to log policy based authorization failures using grpc-c++ libs. 

Typical flow includes

std::shared_ptr<grpc::experimental::AuthorizationPolicyProviderInterface> provider = grpc::experimental::FileWatcherAuthorizationPolicyProvider::Create(policyFile, 10, &status)

builder.experimental().SetAuthorizationPolicyProvider(provider);

This will load the policy file and authorize the incoming rpc requests. Are there any hooks available to interact with the policy engine to log the denied rpcs requests?

Appreciate your feedback, Thank you.

[Mark D. Roth]

There is an experimental audit logging API you can use for this.  See gRFC A59 for details.  The actual exposed C++ API for you to use is here.

[Rameshreddy Mudhireddy]

Thank you Mark for the information. This is very useful but unfortunately it doesn't give all the details that are needed for my use case. I am looking for specifically details like client ip where the rpc is originated from, user who issued the rpc, client certificate to read commonName, etc.

on mtls(other cases work), audit logging api is hitting a GPR_ASSERT, any idea what could be missing ?

 [audit_logging.cc:57]                  ASSERTION FAILED: registry->logger_factories_map_.emplace(name, std::move(factory)).second

Once again thank you for all your input, I really appreciate it.

[Rameshreddy Mudhireddy]

please ignore the GPR_ASSERT issue, that was my bad in setting up RegisterAuditLoggerFactory, that works.

[Luwei Ge]

Hi Rameshreddy,

Looks like you want to log things that are not currently available in the audit context we have defined. Would you mind opening an issue on GitHub for such a feature request?

Best,

Luwei

[Rameshreddy Mudhireddy]

Thanks Luwei, opened feature request https://github.com/grpc/grpc/issues/38708

[Rameshreddy Mudhireddy]

Hi Mark,

Can you please provide your input on the following audit logging API query

https://groups.google.com/g/grpc-io/c/C3Jvipb_hYI

Best Regards,

Ramesh