[FEATURE] Security plugin config entries should have a created_at and updated_at timestamp

[cwperks]

Is your feature request related to a problem?

Config entries in the security index such as users, roles and roles_mappings have no timestamps associated with them to indicate when the entry was created or when it was most recently modified. When investigating issues, its often helpful to have this contextual information to determine when a change was made to help locate more information about the change. In many frameworks like Ruby on Rails, these timestamps come as a convention to track any objects that get persisted.

Each entry in the security index (i.e. a user or a role) should have these timestamps on the entry. This entry would help a cluster admin identify when a particular user/role/role_mapping/etc. is created or last modified.

What solution would you like?

Add created_at and updated_at timestamps to config entries in the security index.

Example

Each entry, such as this example for user has both of these values

admin:
  hash: "$2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG"
  reserved: true
  backend_roles:
  - "admin"
  description: "Demo admin user"
  created_at: 2023‐08‐30T06:05:02Z
  updated_at 2023‐09‐01T08:09:03Z

[stephen-crawford]

[Triage] Hey @cwperks, could you provide some more info as to the action items required for the change? If someone goes to complete the issue, I think we will want them to know how the created_at and updated_at fields are related to the objects you are referring to. For instance, if a user has a role, and then the role is updated, doe the user also get the new updated_at field?

[stephen-crawford]

[Triage] @cwperks just following-up.

[peternied]

2 cents - I think adding a setting like this would help cluster operators troubleshoot behavior that might have been due to a config change. Without this change that kind of diagnosis is not possible

[cwperks]

@scrawfor99 I think it should be only when that particular config entry was updated. i.e. if a roles_mapping is updated to map the user craig to role custom_role, then it would be the config entry corresponding to the roles_mapping for custom_role that should update its updated_at timestamp.

If the user craig changed their password then I would expect the updated_at timestamp to reflect when the craig internal_user config entry was last updated.

[peternied]

@RyanL1997 FYI - I updated the description to include an example for user simaliar to what @cwperks mentioned; consider this as you create a solution

[cwperks]

Closing this issue in favor of #5093. In general, it would be useful to know when a particular config entry was last modified.