Skip to content

Enhance existing OAuth application authorisation audit event

Audit need

Enhance existing audit event for OAuth application authorisation by adding scopes and application url in the audit event.

Proposal

Current audit event(streaming) when an OAuth application is added looks as follows

{
  "id": 123456789,
  "author_id": 123456789,
  "entity_id": 123456789,
  "entity_type": "Group",
  "details": {
    "custom_message": "OAuth application added",
    "author_name": "Person",
    "target_id": 123456789,
    "target_type": "User",
    "target_details": "testest",
    "ip_address": "11.22.33.44",
    "entity_path": "gitlab"
  },
  "ip_address": "11.22.33.44",
  "author_name": "Person",
  "entity_path": "gitlab",
  "target_details": "testest",
  "created_at": "2025-03-04T06:22:03.793Z",
  "target_type": "User",
  "target_id": 123456789,
  "event_type": "audit_operation"
}

It doesn't provide information about the scopes and OAuth application redirect uri/Application URL. This information could be useful to monitor the sensitive scopes and match against known malicious IOCs.

Streaming-only event or normal event?

The event seems to be present in the audit_json subcomponent of rails log. We need to expose it to the stream event as well

Edited by 🤖 GitLab Bot 🤖