Unified masked logging for CREATE/ALTER USER

Detail name	Value
Changelog Number	13623
Type	Improvement
Status	Resolved
Fix Versions	Exasol 7.1.5, Exasol 7.0.15
Resolution Date	2022-01-26

Background

The commands CREATE/ALTER USER are logged by masking the credentials with the constant string <SECRET>.

CREATE USER user_1 IDENTIFIED BY "foo";
--> CREATE USER user_1 IDENTIFIED BY '<SECRET>'

CREATE USER user_2 IDENTIFIED AT LDAP AS 'cn=user_2,dc=authorization,dc=exasol,dc=com' force;
--> CREATE USER user_2 IDENTIFIED AT LDAP AS '<SECRET>' force

Improvement

CREATE/ALTER USER using OPENID or Kerberos now follow the same pattern as PASSWORD or LDAP for masking Kerberos Principal or OpenId Subject in the log and auditing.

CREATE USER user_3 IDENTIFIED BY OPENID SUBJECT 'database-user@exasol.example';
--> CREATE USER user_3 IDENTIFIED BY OPENID SUBJECT '<SECRET>'

CREATE USER user_4 IDENTIFIED by kerberos principal 'hmm?';
--> CREATE USER user_4 IDENTIFIED BY KERBEROS PRINCIPAL '<SECRET>'