@@ -5,6 +5,7 @@ package audit
55
66import (
77 "context"
8+ "encoding/json"
89 "errors"
910 "fmt"
1011 "maps"
@@ -253,6 +254,46 @@ func clone[V any](s V) (V, error) {
253254 return s2 .(V ), err
254255}
255256
257+ // mergeEnterpriseTokenMetadata injects enterprise token fields from a logical.Request
258+ // into the audit auth's Metadata map.
259+ func mergeEnterpriseTokenMetadata (a * auth , req * logical.Request ) error {
260+ if a == nil || req == nil {
261+ return nil
262+ }
263+
264+ if req .EnterpriseTokenMetadata == "" &&
265+ req .EnterpriseTokenIssuer == "" &&
266+ len (req .EnterpriseTokenAudience ) == 0 &&
267+ len (req .EnterpriseTokenAuthorizationDetails ) == 0 {
268+ return nil
269+ }
270+
271+ if a .Metadata == nil {
272+ a .Metadata = make (map [string ]string )
273+ }
274+ if req .EnterpriseTokenMetadata != "" {
275+ a .Metadata ["enterprise_token_metadata" ] = req .EnterpriseTokenMetadata
276+ }
277+ if req .EnterpriseTokenIssuer != "" {
278+ a .Metadata ["enterprise_token_issuer" ] = req .EnterpriseTokenIssuer
279+ }
280+ if len (req .EnterpriseTokenAudience ) > 0 {
281+ audJSON , err := json .Marshal (req .EnterpriseTokenAudience )
282+ if err != nil {
283+ return fmt .Errorf ("unable to marshal enterprise token audience for audit: %w" , err )
284+ }
285+ a .Metadata ["enterprise_token_audience" ] = string (audJSON )
286+ }
287+ if len (req .EnterpriseTokenAuthorizationDetails ) > 0 {
288+ authzJSON , err := json .Marshal (req .EnterpriseTokenAuthorizationDetails )
289+ if err != nil {
290+ return fmt .Errorf ("unable to marshal enterprise token authorization details for audit: %w" , err )
291+ }
292+ a .Metadata ["enterprise_token_authorization_details" ] = string (authzJSON )
293+ }
294+ return nil
295+ }
296+
256297// newAuth takes a logical.Auth and the number of remaining client token uses
257298// (which should be supplied from the logical.Request's client token), and creates
258299// an audit auth.
@@ -281,6 +322,18 @@ func newAuth(input *logical.Auth, tokenRemainingUses int) (*auth, error) {
281322 return nil , fmt .Errorf ("unable to clone logical auth: metadata: %w" , err )
282323 }
283324
325+ if input .ActorEntityID != "" || input .ActorEntityName != "" {
326+ if metadata == nil {
327+ metadata = make (map [string ]string )
328+ }
329+ if input .ActorEntityID != "" {
330+ metadata ["actor_entity_id" ] = input .ActorEntityID
331+ }
332+ if input .ActorEntityName != "" {
333+ metadata ["actor_entity_name" ] = input .ActorEntityName
334+ }
335+ }
336+
284337 policies , err := clone (input .Policies )
285338 if err != nil {
286339 return nil , fmt .Errorf ("unable to clone logical auth: policies: %w" , err )
@@ -535,6 +588,10 @@ func (f *entryFormatter) createEntry(ctx context.Context, a *Event) (*entry, err
535588 return nil , fmt .Errorf ("cannot convert auth: %w" , err )
536589 }
537590
591+ if err := mergeEnterpriseTokenMetadata (auth , data .Request ); err != nil {
592+ return nil , err
593+ }
594+
538595 req , err := newRequest (data .Request , ns )
539596 if err != nil {
540597 return nil , fmt .Errorf ("cannot convert request: %w" , err )
@@ -548,6 +605,12 @@ func (f *entryFormatter) createEntry(ctx context.Context, a *Event) (*entry, err
548605 return nil , fmt .Errorf ("cannot convert response: %w" , err )
549606 }
550607
608+ if resp != nil && resp .Auth != nil {
609+ if err := mergeEnterpriseTokenMetadata (resp .Auth , data .Request ); err != nil {
610+ return nil , err
611+ }
612+ }
613+
551614 // If the plugin's response contained any additional audit request fields,
552615 // lets populate them on our original request.
553616 if data .Response != nil && data .Response .SupplementalAuditRequestData != nil {
0 commit comments