[CASSANDRA-19669] Audit Log entries are missing identity for mTLS connections

• Type: Bug
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 5.1
• Component/s: Local/Config
• Bug Category: Correctness - Recoverable Corruption / Loss
• Severity: Normal
• Complexity: Normal
• Discovered By: Adhoc Test
• Platform: All
• Since Version: NA

Source Control Link

https://github.com/apache/cassandra/commit/bb68141861e77623f0d0b13f72846651a71c1017

Test and Documentation Plan

Added tests covering the identity in the audit log entry and code fixes

• Assignee: Francisco Guerrero Assign to me
• Reporter: Francisco Guerrero

Authors

Francisco Guerrero

Reviewers

Bernardo Botella, Francisco Guerrero

• Created: 29/May/24 21:11
• Updated: 10/Jun/24 21:37
• Resolved: 10/Jun/24 21:37

Description

Audit log entries are missing the IDENTITY when an mTLS connection is established. Currently, the client state is captured as part of the audit log entries, however the additional metadata for the authenticated user does not get propagated to the entry. For the mTLS connections, this means that the identity information is not included to the log entry details.

Additionally, when a TLS connection is terminated during handshake (say a client is using an expired certificate) the error is not propagated to the audit log failure attempts.

Issue Links

• links to: GitHub Pull Request #3340