question No value for effective user (PROXY_USER_NAME) in gateway-audit.log file. in Archives of Support Questions (Read Only)

No value for effective user (PROXY_USER_NAME) in gateway-audit.log file.

systemize — Thu, 19 Jan 2017 21:28:45 GMT

What does it mean if the gateway-audit.log does not show a value for the PROXY_USER_NAME audit log field when I make a successful REST API call to Knox/webhdfs? I am assuming there should always be a value in the log for the effective user (PROXY_USER_NAME)? [1]

Log file example:

17/01/19 10:44:09 ||8945e8d7-eb49-45da-93c4-43d47ccdc3fb|audit|WEBHDFS|guest|||authentication|uri|/gateway/default/webhdfs/v1/?op=LISTSTATUS|success|Groups: []

17/01/19 10:44:09 ||8945e8d7-eb49-45da-93c4-43d47ccdc3fb|audit|WEBHDFS|guest|||authorization|uri|/gateway/default/webhdfs/v1/?op=LISTSTATUS|success| 

17/01/19 10:44:09 ||8945e8d7-eb49-45da-93c4-43d47ccdc3fb|audit|WEBHDFS|guest|||dispatch|uri|http://namenode:50070/webhdfs/v1/?user.name=guest&op=LISTSTATUS|success|Response status: 200

17/01/19 10:44:09 ||8945e8d7-eb49-45da-93c4-43d47ccdc3fb|audit|WEBHDFS|guest|||access|uri|/gateway/default/webhdfs/v1/?op=LISTSTATUS|success|Response status: 200

refs: [1] http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.3.0/bk_Knox_Gateway_Admin_Guide/content/audit_log_files.html

Re: No value for effective user (PROXY_USER_NAME) in gateway-audit.log file.

lmccay — Fri, 20 Jan 2017 01:08:34 GMT

The PROXY_USER_NAME is actually poorly named. This value is only populated if principal mapping within identity assertion is done to map the authenticated user to another username to proxy to the backend service. It should probably be called MAPPED_USER or something like that. See: http://knox.apache.org/books/knox-0-11-0/user-guide.html#Audit

Re: No value for effective user (PROXY_USER_NAME) in gateway-audit.log file.

systemize — Fri, 20 Jan 2017 04:38:20 GMT

Thank you for the quick response. matts