Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 2055465

Summary: 389ds audit log does not log IdM WebUI activity
Product: Red Hat Enterprise Linux 8 Reporter: Sunny Wu <suwu>
Component: ipaAssignee: Florence Blanc-Renaud <frenaud>
Status: CLOSED NOTABUG QA Contact: ipa-qe <ipa-qe>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 8.4CC: rcritten, tscherf
Target Milestone: rcFlags: pm-rhel: mirror+
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-02-17 08:27:27 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Sunny Wu 2022-02-17 03:10:49 UTC 
Description of problem:

389ds audit log does not record database changes when update through IdM WebUI 

- Attempting to log users' password changes to IdM servers. 
- "nsslapd-auditlog-logging-enabled" option is enabled
- /var/log/dirsrv/slapd-<..>/audit records password changes through command line: e.g.
  - ipa user-mod <user> --password
- /var/log/dirsrv/slapd-<..>/audit does not record password changes through WebUI

====

- Enable audit log:

# dsconf -D "cn=Directory Manager" ldap://<...>.redhat.com config replace nsslapd-auditlog-logging-enabled=on
Enter password for cn=Directory Manager on ldap://<...>.redhat.com: 
Successfully replaced "nsslapd-auditlog-logging-enabled"

- Password change:

$ ipa user-mod bob --password
Password: 
Enter Password again to verify: 
-------------------
Modified user "bob"
-------------------
  User login: bob
  First name: Bob
  Last name: User
  Home directory: /home/bob
  Login shell: /bin/sh
  Principal name: bob@<...>.REDHAT.COM
  Principal alias: bob@<...>.REDHAT.COM
  Email address: bob@<...>.redhat.com
  UID: 1200600003
  GID: 1200600003
  Account disabled: False
  Password: True
  Member of groups: ipausers
  Kerberos keys available: True

- Corresponding audit log in /var/log/dirsrv/slapd-<...>-REDHAT-COM/audit

time: 20220217124738
dn: uid=bob,cn=users,cn=accounts,<...>,dc=redhat,dc=com
result: 0
changetype: modify
replace: userPassword
userPassword:: e1BCS0RGMl9TSEEyNTZ9QUFBSUFHL2FBb3VLTDZPTXVXcHlGbktTaEFrZnJYT1Z
 Ed2JiL3FtUm13bnlHeUZKNkZvUmlRd0lkaTN2RE91MTZGQVJRck1teG9LVlF3TW8yUzRTeWtJS3BT
 <...>
 TDhtTFJNd0xYbGxIVml6VEJhYXhZd3FzYnRKR0ZhbTZINzh1c0dnRUlyNkYxMXFsVGNsb3NUSHpuQ
 3hIYXFGam9Yb3lCWmw0SEtHZjRyZ2QwRmNseHpubTVoNmlkTGlQbUVwbDNPZXFjNDU2MDUy
-
replace: modifiersname
modifiersname: uid=admin,cn=users,cn=accounts,<...>,dc=redhat,dc=com
-
replace: modifytimestamp
modifytimestamp: 20220217024738Z
-
replace: entryusn
entryusn: 1647
-
replace: krbPrincipalKey
krbPrincipalKey:: MIHeoAMCAQGhAwIBAaIDAgEDowMCAQGkgccwgcQwaKAbMBmgAwIBBKESBBAp
 <...>
 VEBKyg2ME
-
replace: ipaNTHash
ipaNTHash:: X9uadOsj1BdIocEobDCLHA==
-

- However, if password is updated via IdM WebUI either by admin reset or user initiated changes, no log is recorded.

---

Version-Release number of selected component (if applicable):

# rpm -qa | grep ipa | sort
ipa-client-4.9.6-10.module+el8.5.0+13587+92118e57.x86_64
ipa-client-common-4.9.6-10.module+el8.5.0+13587+92118e57.noarch
ipa-common-4.9.6-10.module+el8.5.0+13587+92118e57.noarch
ipa-healthcheck-0.7-6.module+el8.5.0+11410+91a33fe4.noarch
ipa-healthcheck-core-0.7-6.module+el8.5.0+11410+91a33fe4.noarch
ipa-selinux-4.9.2-4.module+el8.4.0+11156+94d209c1.noarch
ipa-server-4.9.6-10.module+el8.5.0+13587+92118e57.x86_64
ipa-server-common-4.9.6-10.module+el8.5.0+13587+92118e57.noarch
ipa-server-dns-4.9.6-10.module+el8.5.0+13587+92118e57.noarch
ipa-server-trust-ad-4.9.6-10.module+el8.5.0+13587+92118e57.x86_64
libipa_hbac-2.4.0-9.el8.x86_64
python3-iniparse-0.4-31.el8.noarch
python3-ipaclient-4.9.6-10.module+el8.5.0+13587+92118e57.noarch
python3-ipalib-4.9.6-10.module+el8.5.0+13587+92118e57.noarch
python3-ipaserver-4.9.6-10.module+el8.5.0+13587+92118e57.noarch
python3-libipa_hbac-2.4.0-9.el8.x86_64
redhat-logos-ipa-84.5-1.el8.noarch
sssd-ipa-2.4.0-9.el8.x86_64

How reproducible:
   Always

Actual results:
   Password changes via IdM WebUI is not logged to audit log

Expected results:
   Password changes via IdM WebUI should be logged

Additional info:
Comment 1 Florence Blanc-Renaud 2022-02-17 08:27:27 UTC 
The WebUI is changing the password using the ipa_pwd_extop plugin, through a LDAP extended operation (Password Modify Extended Op defined by the OID 1.3.6.1.4.1.4203.1.11.1).
The plugin operations can be logged in the audit log by setting the plugin's nsslapd-logAudit attribute to on, as described in: 
https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/html-single/configuration_command_and_file_reference/index#List_of_Attributes_Common_to_All_Plug_ins-nsslapd_logaudit

If the customer wants to log this op in the audit log, the dse.ldif file must contain an entry similar to:
dn: cn=ipa_pwd_extop,cn=plugins,cn=config
nsslapd-logaudit: on

Closing this BZ as not a bug.