[AMBARI-25234] Ambari audit log shows "null" user when executing an API call as admin - Ambari 2.7.3

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.5.2, 2.7.3
• Fix Version/s: 2.8.0, 2.7.4
• Component/s: ambari-server
• Labels: newbie pull-request-available

Environment

RHEL 7.x

• Assignee: Krisztian Kasa
• Reporter: Saurabh Lambe
• Created: 08/Apr/19 10:21
• Updated: 04/Nov/22 03:19
• Resolved: 12/Apr/19 04:54

Description

When running a simple REST API call from CLI, I could see two entries in ambari-audit.log file.

 

Following is my API call:

curl -k -i -u admin:<passwd> -H "X-Requested-By: ambari" -X GET http://<ambari-host>:8080/api/v1/clusters

 

Following are the 2 entries in ambari-audit.log:

2019-04-08T10:19:04.991Z, User(null), RemoteIp(x.x.x.x), Operation(User login), Roles(
), Status(Failed), Reason(Authentication required), Consecutive failures(UNKNOWN USER)
2019-04-08T10:19:04.999Z, User(admin), RemoteIp(x.x.x.x), Operation(User login), Roles(
    Ambari: Ambari Administrator
), Status(Success)

 

The second line seems to be valid. However, the first line (with the null user) shouldn't be there.

Note: I'm not sure if it helps, but the cluster is Kerberized and Knox isn't involved.

 

Edit: This issue could be seen on both Ambari 2.5.2 and 2.7.3. Also, 2.5.2 version cluster is Kerberized, the 2.7.3 version is NOT Kerberized. 

Issue Links

• is cloned by: AMBARI-25247 CLONE - Ambari audit log shows "null" user when executing an API call as admin - Ambari 2.5.2
• is cloned by: AMBARI-25368 CLONE - Ambari audit log shows "null" user when executing an API call as admin - Ambari 2.6.2
• links to: GitHub PR#3443
• links to: GitHub Pull Request #2925
• links to: GitHub Pull Request #2934