Method and apparatus for logging privilege use in a distributed computing environment

Abstract

One embodiment of the present invention provides a system that logs the use of privileges in a distributed computing environment. The distributed computing environment includes a database system, one or more client applications, and a unified security management layer between the database system and the one or more client applications. During operation, the system receives a request from a client application to execute a business function in the distributed computing environment. The system determines a privilege associated with the requested business function, and logs that the request is associated with the privilege. The system then checks, in the unified security management layer, whether a user associated with the request is associated with a role that has the privilege. If the user is associated with a role that has the privilege, the system performs the requested business function. By checking and logging privilege access in the unified security management layer, the system facilitates tracking privilege use for the database system and the client applications in a single entity, thereby enabling security managers to more easily audit privileged operations in the distributed computing environment.