Enhance existing OAuth application authorisation audit event
Audit need
Enhance existing audit event for OAuth application authorisation
by adding scopes
and application url
in the audit event.
Proposal
Current audit event(streaming) when an OAuth application is added looks as follows
{
"id": 123456789,
"author_id": 123456789,
"entity_id": 123456789,
"entity_type": "Group",
"details": {
"custom_message": "OAuth application added",
"author_name": "Person",
"target_id": 123456789,
"target_type": "User",
"target_details": "testest",
"ip_address": "11.22.33.44",
"entity_path": "gitlab"
},
"ip_address": "11.22.33.44",
"author_name": "Person",
"entity_path": "gitlab",
"target_details": "testest",
"created_at": "2025-03-04T06:22:03.793Z",
"target_type": "User",
"target_id": 123456789,
"event_type": "audit_operation"
}
It doesn't provide information about the scopes and OAuth application redirect uri/Application URL. This information could be useful to monitor the sensitive scopes and match against known malicious IOCs.
Streaming-only event or normal event?
The event seems to be present in the audit_json subcomponent of rails log. We need to expose it to the stream event as well
Edited by 🤖 GitLab Bot 🤖