Red Hat Connectivity Link

Use an audit trail without authentication

If you do not have an authentication layer, the routing headers still offer useful audit context.

The mcp_user_id field is empty (-), but you can still see the following details:

Which tool a user called
On which server the call took place
In which session the call took place
At what time the call took place
How long the interaction lasted

You can configure the x-auth-identity header name and the JSON web token (JWT) claim in the AuthPolicy CR. Adjust the spec.defaults.rules.response.success.headers section to match your identity provider according to the following list:

Red Hat build of Keycloak: auth.identity.preferred_username or auth.identity.email.
Generic OIDC: auth.identity.sub; this is the subject claim, always present in JWTs.
Custom claims: auth.identity.<claim_name> for any claim in the JWT payload.

Important

If you change the header name, you must also update the mcp_user_id field in your MeshConfig extension provider to match the %REQ(<HEADER_NAME>)% format.

Generic OIDC AuthPolicy CR header configuration example

apiVersion: kuadrant.io/v1
kind: AuthPolicy
metadata:
  name: <audit_no_auth_client_listener>
  namespace: <gateway_namespace>
spec:
#...
  defaults:
#...
    rules:
#...
      response:
        success:
          headers:
            "x-auth-identity":
              plain:
                selector: auth.identity.sub
#...