CASBIN_USER_NAME_HEADERS configuration for audit logging with user name

[jessecooper]

CASBIN_USER_NAME_HEADERS configuration for audit logging with user name

This enables auditing logging with user name when a user is trying to access resources they do not have access to.

Flask Application Configuration Example:

...
# Set up Casbin model config
app.config['CASBIN_MODEL'] = 'casbinmodel.conf'
# Set headers where owner for enforcement policy should be located
app.config['CASBIN_OWNER_HEADERS'] = {'X-User', 'X-Group'}
# Add User Audit Logging with user name associated to log
app.config['CASBIN_USER_NAME_HEADERS'] = {'X-User'}
...

Output Example:

[2020-11-10 12:55:06,060] ERROR in casbin_enforcer: Unauthorized attempt: method: GET resource: /api/v1/resources by user: janedoe@example.com

Requirement:
The requirement comes from APPLICATION SECURITY AND DEVELOPMENT (ASD) SRG-APP-000492:

SRG-APP-000492 - The application must generate audit records when successful/unsuccessful attempts to access security objects occur.

[marchingphoenix]

looks good to me

[dfresh613]

Per http protocol headers are not case sensitive, perhaps we should ensure we support that here, or when we load by forcing everything .lower()?

Should we also include a unit test matching this same path?

[jessecooper]

Good call out. Let me look into what flask is doing with the headers in the request. They might be doing a .upper() on it.

[jessecooper]

added changes to remove case sensitivity