ATLAS-10930: log which RBAC check (rbac/entitlement) failed authz

[rchowinfoblox]

$ make test
go vet ./...
go test ./...
ok      github.com/infobloxopen/atlas-authz-middleware/grpc_opa (cached)
ok      github.com/infobloxopen/atlas-authz-middleware/pkg/opa_client   (cached)

[drewwells]

I think obligation logs need to be more targeted and opt-in. We will get complaints that middleware is logging errors that people can not turn off.

[drewwells]

this will make it easier to find in kibana

Suggested change

	logger.Infof("Request forbidden because these RBAC checks failed:%s", forbidReason)
	logger.WithField("msg", forbidReason).Info("obligation_forbidden msg")

[drewwells]

Shouldn't we first check that an obligation was expected? This is going to be triggered and have no message for 100% of authz failures today.

[drewwells]

I think the signature needs work here. We should distinguish lack of obligations from a specific obligation denial. You could also do that by emitting an error instead of a string. err == nil nothing about obligations to report.

Also, how do services turn these logs off if they don't want them? Perhaps, don't log at all and return wrapped errors is a better way to enable implementation to choose behavior.

[drewwells]

Another way to surface error messages is to wrap them in the error being returned.

Suggested change

	return false, ctx, ErrForbidden
	return false, ctx, fmt.Errorf("%w: %s", ErrForbidden, forbidReason)

Caller verifies type of error with errors.Is(err, grpc_opa.ErrForbidden)

[rchowinfoblox]

Labeled DO-NOT-MERGE as plan is now to use new print() rego function in more recent OPA versions to improve logging of request/response details in OPA log.