Audit Log Oracle settings (#29566)

api/proto/teleport/legacy/types/types.proto

@@ -316,6 +316,11 @@ message DatabaseSpecV3 {
     (gogoproto.nullable) = false,
     (gogoproto.jsontag) = "mongo_atlas,omitempty"
   ];
+  // Oracle is an additional Oracle configuration options.
+  OracleOptions Oracle = 13 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "oracle,omitempty"
+  ];
 }
 
 // DatabaseAdminUser contains information about privileged database user used
@@ -325,6 +330,13 @@ message DatabaseAdminUser {
   string Name = 1 [(gogoproto.jsontag) = "name"];
 }
 
+// OracleOptions contains information about privileged database user used
+// for database audit.
+message OracleOptions {
+  // AuditUser is the Oracle database user privilege to access internal Oracle audit trail.
+  string AuditUser = 1 [(gogoproto.jsontag) = "audit_user"];
+}
+
 // DatabaseStatusV3 contains runtime information about the database.
 message DatabaseStatusV3 {
   // CACert is the auto-downloaded cloud database CA certificate.

api/types/database.go

@@ -68,6 +68,8 @@ type Database interface {
 	GetStatusCA() string
 	// GetMySQL returns the database options from spec.
 	GetMySQL() MySQLOptions
+	// GetOracle returns the database options from spec.
+	GetOracle() OracleOptions
 	// GetMySQLServerVersion returns the MySQL server version either from configuration or
 	// reported by the database.
 	GetMySQLServerVersion() string
@@ -288,6 +290,11 @@ func (d *DatabaseV3) GetAdminUser() string {
 	return d.Metadata.Labels[DatabaseAdminLabel]
 }
 
+// GetOracle returns the Oracle options from spec.
+func (d *DatabaseV3) GetOracle() OracleOptions {
+	return d.Spec.Oracle
+}
+
 // SupportsAutoUsers returns true if this database supports automatic user
 // provisioning.
 func (d *DatabaseV3) SupportsAutoUsers() bool {
@@ -1144,3 +1151,8 @@ func (s *IAMPolicyStatus) UnmarshalJSON(data []byte) error {
 	*s = IAMPolicyStatus(IAMPolicyStatus_value[stringVal])
 	return nil
 }
+
+// IsAuditLogEnabled returns if Oracle Audit Log was enabled
+func (o OracleOptions) IsAuditLogEnabled() bool {
+	return o.AuditUser != ""
+}

e_imports.go

@@ -73,6 +73,7 @@ import (
 	_ "github.com/russellhaering/gosaml2"
 	_ "github.com/russellhaering/gosaml2/types"
 	_ "github.com/russellhaering/goxmldsig"
+	_ "github.com/sijms/go-ora/v2"
 	_ "github.com/sirupsen/logrus"
 	_ "github.com/stretchr/testify/assert"
 	_ "github.com/stretchr/testify/require"

go.mod

@@ -142,6 +142,7 @@ require (
 	github.com/schollz/progressbar/v3 v3.13.1
 	github.com/segmentio/parquet-go v0.0.0-20230622230624-510764ae9e80
 	github.com/sethvargo/go-diceware v0.3.0
+	github.com/sijms/go-ora/v2 v2.7.9
 	github.com/sirupsen/logrus v1.9.3
 	github.com/snowflakedb/gosnowflake v1.6.23
 	github.com/spf13/cobra v1.7.0
@@ -429,5 +430,6 @@ replace (
 	// otherwise tests fail with a data race detection.
 	github.com/moby/spdystream => github.com/gravitational/spdystream v0.0.0-20230512133543-4e46862ca9bf
 	github.com/redis/go-redis/v9 => github.com/gravitational/redis/v9 v9.0.2-teleport.1
+	github.com/sijms/go-ora/v2 => github.com/gravitational/go-ora/v2 v2.0.0-20230821114616-e2a9f1131a46
 	github.com/vulcand/predicate => github.com/gravitational/predicate v1.3.1
 )

go.sum

@@ -797,6 +797,8 @@ github.com/gravitational/go-mysql v1.5.0-teleport.1 h1:EyFryeiTYyP6KslLVp0Q5QTKw
 github.com/gravitational/go-mysql v1.5.0-teleport.1/go.mod h1:GX0clmylJLdZEYAojPCDTCvwZxbTBrke93dV55715u0=
 github.com/gravitational/go-oidc v0.1.0 h1:qZkEZCuD7DfPbpFfewvRmDvq82XoDsmZtqgpQ0Ep2i4=
 github.com/gravitational/go-oidc v0.1.0/go.mod h1:sLGirtIOd+3KGTw9aE44Ej9vYzoiZzkHXIopMu7603A=
+github.com/gravitational/go-ora/v2 v2.0.0-20230821114616-e2a9f1131a46 h1:k/tkK7NDSH7gjNbA5pdUfAalJXyIVazycM0RW7ZboxM=
+github.com/gravitational/go-ora/v2 v2.0.0-20230821114616-e2a9f1131a46/go.mod h1:EHxlY6x7y9HAsdfumurRfTd+v8NrEOTR3Xl4FWlH6xk=
 github.com/gravitational/httprouter v1.3.1-0.20220408074523-c876c5e705a5 h1:qg8FcGwRACSHortU1UxCSo9nF0t34rPWjk9Nef3j2Ic=
 github.com/gravitational/httprouter v1.3.1-0.20220408074523-c876c5e705a5/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
 github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33 h1:VFER/+0TfRypJhc9XeuggTtEZzhhe75DSVqMv/avHEU=

lib/config/configuration.go

@@ -1480,6 +1480,7 @@ func applyDatabasesConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 			AdminUser: servicecfg.DatabaseAdminUser{
 				Name: database.AdminUser.Name,
 			},
+			Oracle: convOracleOptions(database.Oracle),
 			AWS: servicecfg.DatabaseAWS{
 				AccountID:     database.AWS.AccountID,
 				AssumeRoleARN: database.AWS.AssumeRoleARN,
@@ -1532,6 +1533,12 @@ func applyDatabasesConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 	return nil
 }
 
+func convOracleOptions(o DatabaseOracle) servicecfg.OracleOptions {
+	return servicecfg.OracleOptions{
+		AuditUser: o.AuditUser,
+	}
+}
+
 // readCACert reads database CA certificate from the config file.
 // First 'tls.ca_cert_file` is being read, then deprecated 'ca_cert_file' if
 // the first one is not set.

lib/config/fileconf.go

@@ -1957,6 +1957,8 @@ type Database struct {
 	Azure DatabaseAzure `yaml:"azure"`
 	// AdminUser describes database privileged user for auto-provisioning.
 	AdminUser DatabaseAdminUser `yaml:"admin_user"`
+	// Oracle is Database Oracle settings
+	Oracle DatabaseOracle `yaml:"oracle,omitempty"`
 }
 
 // DatabaseAdminUser describes database privileged user for auto-provisioning.
@@ -1999,6 +2001,12 @@ type DatabaseMySQL struct {
 	ServerVersion string `yaml:"server_version,omitempty"`
 }
 
+// DatabaseOracle are an additional Oracle database options.
+type DatabaseOracle struct {
+	// AuditUser is the Oracle database user privilege to access internal Oracle audit trail.
+	AuditUser string `yaml:"audit_user,omitempty"`
+}
+
 // SecretStore contains settings for managing secrets.
 type SecretStore struct {
 	// KeyPrefix specifies the secret key prefix.

lib/service/servicecfg/database.go

@@ -72,14 +72,22 @@ type Database struct {
 	Azure DatabaseAzure
 	// AdminUser contains information about database admin user.
 	AdminUser DatabaseAdminUser
+	// Oracle are additional Oracle database options.
+	Oracle OracleOptions
 }
 
-// DatabaesAdminUser contains information about database admin user.
+// DatabaseAdminUser contains information about database admin user.
 type DatabaseAdminUser struct {
 	// Name is the database admin username (e.g. "postgres").
 	Name string
 }
 
+// OracleOptions are additional Oracle options.
+type OracleOptions struct {
+	// AuditUser is the Oracle database user privilege to access internal Oracle audit trail.
+	AuditUser string
+}
+
 // CheckAndSetDefaults validates the database proxy configuration.
 func (d *Database) CheckAndSetDefaults() error {
 	if err := enterprise.ProtocolValidation(d.Protocol); err != nil {
@@ -152,6 +160,7 @@ func (d *Database) ToDatabase() (types.Database, error) {
 		AdminUser: &types.DatabaseAdminUser{
 			Name: d.AdminUser.Name,
 		},
+		Oracle: convOracleOptions(d.Oracle),
 		AWS: types.AWS{
 			AccountID:     d.AWS.AccountID,
 			AssumeRoleARN: d.AWS.AssumeRoleARN,
@@ -199,6 +208,12 @@ func (d *Database) ToDatabase() (types.Database, error) {
 	})
 }
 
+func convOracleOptions(o OracleOptions) types.OracleOptions {
+	return types.OracleOptions{
+		AuditUser: o.AuditUser,
+	}
+}
+
 // MySQLOptions are additional MySQL options.
 type MySQLOptions struct {
 	// ServerVersion is the version reported by Teleport DB Proxy on initial handshake.

tool/tsh/common/tsh_test.go

@@ -3658,6 +3658,9 @@ func TestSerializeDatabases(t *testing.T) {
         "redshift_serverless": {}
       },
       "mysql": {},
+      "oracle": {
+        "audit_user": ""
+      },
       "gcp": {},
       "azure": {
 	    "redis": {}