audit log for DataStage user access provision at group level

Issue:- Audit log events missing for user access provision at group level

we need audit events logged with below details when user access is provisioned/deprovisioned at group level on both CPD platform & DataStage project level.

1. User ID who got access

2. User ID who granted access

3. group name which user got added/removed

4. Role that was granted/revoked

5. DataStage project name user/group got access to

Background

Reference IBM case: TS019531851

with current version of CPD 5.0.3, zen-audit log captures audit details only at USER level but not at GROUP level as described in below URL for following events. as we manage user access provision at group level, we need audit events to be logged in zen-audit at group level also.

https://www.ibm.com/docs/en/cloud-paks/cp-data/5.0.x?topic=events-cloud-pak-data-platform

User Management

• users.user.create - Authorize a user for access to the platform.

• users.user.delete - Remove access to the platform for user.

• users.user.update - Make changes in a user's profile, including name, email address.

• users.role.add - Grant a specific privilege to a user on the platform.

• users.role.remove - Revoke a platform privilege from a user

User access is granted in cloud pak for data at 2 levels for DataStage.

CPD platform level

CPD DataStage project level

We tested at both the levels for audit events in zen-audit log with IBM support in web meeting summary is given below

At CPD platform level,

1. added user to the existing group

2. removed a user from an existing group

in both the above cases user that got added or removed and group name were NOT logged in zen-audit log.

but we see some entries with id with which we tried above operations in the log. these details are NOT sufficient to support AUDIT.

At DataStge service level,

access was provisioned to an existing group with EDITOR role to DataStage project.

But none of the below were logged in zen-audit except some entries with ID which we tried above operations in the log. We need these details to be logged to support AUDIT on monthly basis.

group name

role

DataStage project name

Summary is we need audit events logged with below details when user access is provisioned/deprovisioned at group level on both CPD platform & DataStage project level.

1. User ID who got access

2. User ID who granted access

3. group name which user got added/removed

4. Role that was granted/revoked

5. DataStage project name user/group got access to