From bae92ffc473c3a8d4a070f26e2f607f997736b7d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vin=C3=ADcius=20Ferr=C3=A3o?=
 <2031761+viniciusferrao@users.noreply.github.com>
Date: Thu, 20 Aug 2026 17:37:19 -0300
Subject: [PATCH] fix(credentials): audit delegated certificate signing

---
 xCAT-server/lib/xcat/plugins/credentials.pm |  7 +++++++
 xCAT-test/unit/credentials_service_node.t   | 11 +++++++++++
 2 files changed, 18 insertions(+)

diff --git a/xCAT-server/lib/xcat/plugins/credentials.pm b/xCAT-server/lib/xcat/plugins/credentials.pm
index 1966637d3..4f5901771 100644
--- a/xCAT-server/lib/xcat/plugins/credentials.pm
+++ b/xCAT-server/lib/xcat/plugins/credentials.pm
@@ -96,6 +96,13 @@ sub process_request
             $callback->({ error => ["Unable to sign certificate for $node"], errorcode => [1] });
             return;
         }
+        my $peer = $request->{'_xcat_clientip'}
+          ? $request->{'_xcat_clientip'}->[0]
+          : $request->{'_xcat_clienthost'}
+          ? $request->{'_xcat_clienthost'}->[0]
+          : $request->{'_xcat_clientfqdn'}->[0];
+        xCAT::MsgUtils->trace(0, 'I',
+            "credentials: signed certificate for $node requested by $peer");
         $callback->({ data => [{ content => [$certificate], desc => ['x509cert'] }] });
         return;
     }
diff --git a/xCAT-test/unit/credentials_service_node.t b/xCAT-test/unit/credentials_service_node.t
index 6dc99a664..b1cfed285 100644
--- a/xCAT-test/unit/credentials_service_node.t
+++ b/xCAT-test/unit/credentials_service_node.t
@@ -342,6 +342,7 @@ is( $error, 'The management node is not configured',
     'missing site.master has a specific error' );
 
 $xCAT::Table::servicenode = 'service-a';
+@xCAT::MsgUtils::messages = ();
 my @callback;
 {
     no warnings 'redefine';
@@ -374,6 +375,16 @@ is_deeply(
     ],
     'authorized delegated request returns only the signed certificate'
 );
+is_deeply(
+    $xCAT::MsgUtils::messages[-1],
+    [
+        'xCAT::MsgUtils',
+        0,
+        'I',
+        'credentials: signed certificate for compute-01 requested by 192.0.2.21',
+    ],
+    'successful delegated signing records the node and service node address'
+);
 
 @callback = ();
 xCAT_plugin::credentials::process_request(