[java-identity-provider] branch maint-4 updated: IDP-2039 - Add audit logging to login flows
Scott Cantor
cantor.2 at osu.edu
Mon Dec 5 20:53:33 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch maint-4
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=b9a67338d633cc054bf3b4d25b59126c9509dc71
The following commit(s) were added to refs/heads/maint-4 by this push:
new b9a67338d IDP-2039 - Add audit logging to login flows
b9a67338d is described below
commit b9a67338d633cc054bf3b4d25b59126c9509dc71
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Dec 5 15:53:30 2022 -0500
IDP-2039 - Add audit logging to login flows
https://shibboleth.atlassian.net/browse/IDP-2039
Small enhancements to audit actions.
Move some tests around to fix dependency cycles.
---
idp-profile-impl/pom.xml | 25 -------------------
.../profile/audit/impl/PopulateAuditContext.java | 24 +++++++++++++++++-
.../idp/profile/audit/impl/WriteAuditLog.java | 29 ++++++++++++++++++++--
.../audit/impl/PopulateAuditContextTest.java | 27 ++++++++++++++++++--
idp-profile-spring/pom.xml | 22 +++++++++++++++-
.../profile/impl/tests}/FilterAttributesTest.java | 3 ++-
.../profile/impl/tests}/ResolveAttributesTest.java | 3 ++-
.../idp/profile/impl/tests/package-info.java | 21 ++++++++++++++++
...teriaRelyingPartyConfigurationResolverTest.java | 5 +++-
.../idp/relyingparty/impl/tests/package-info.java | 21 ++++++++++++++++
10 files changed, 146 insertions(+), 34 deletions(-)
diff --git a/idp-profile-impl/pom.xml b/idp-profile-impl/pom.xml
index f4b369f0e..951f2c912 100644
--- a/idp-profile-impl/pom.xml
+++ b/idp-profile-impl/pom.xml
@@ -158,12 +158,6 @@
<type>test-jar</type>
<scope>test</scope>
</dependency>
- <dependency>
- <groupId>${project.groupId}</groupId>
- <artifactId>idp-attribute-filter-impl</artifactId>
- <version>${project.version}</version>
- <scope>test</scope>
- </dependency>
<dependency>
<groupId>${project.groupId}</groupId>
<artifactId>idp-attribute-resolver-api</artifactId>
@@ -171,25 +165,6 @@
<type>test-jar</type>
<scope>test</scope>
</dependency>
- <dependency>
- <groupId>${project.groupId}</groupId>
- <artifactId>idp-attribute-resolver-impl</artifactId>
- <version>${project.version}</version>
- <scope>test</scope>
- </dependency>
- <dependency>
- <groupId>${project.groupId}</groupId>
- <artifactId>idp-attribute-resolver-impl</artifactId>
- <version>${project.version}</version>
- <type>test-jar</type>
- <scope>test</scope>
- </dependency>
- <dependency>
- <groupId>${project.groupId}</groupId>
- <artifactId>idp-saml-impl</artifactId>
- <version>${project.version}</version>
- <scope>test</scope>
- </dependency>
<dependency>
<groupId>net.shibboleth.ext</groupId>
<artifactId>spring-extensions</artifactId>
diff --git a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/PopulateAuditContext.java b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/PopulateAuditContext.java
index aaf42908d..d48748c27 100644
--- a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/PopulateAuditContext.java
+++ b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/PopulateAuditContext.java
@@ -87,6 +87,9 @@ public class PopulateAuditContext extends AbstractProfileAction {
/** Convert date/time fields to default time zone. */
private boolean useDefaultTimeZone;
+ /** Flag signalling to clear context on entry. */
+ private boolean clearAuditContext;
+
/** {@link AuditContext} to populate. */
@Nullable private AuditContext auditCtx;
@@ -188,6 +191,21 @@ public class PopulateAuditContext extends AbstractProfileAction {
useDefaultTimeZone = flag;
}
+ /**
+ * Sets whether to clear any existing fields from the audit context.
+ *
+ * <p>Defaults to false.</p>
+ *
+ * @param flag flag to set
+ *
+ * @since 4.3.0
+ */
+ public void setClearAuditContext(final boolean flag) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ clearAuditContext = flag;
+ }
+
/** {@inheritDoc} */
@Override
protected void doInitialize() throws ComponentInitializationException {
@@ -204,7 +222,7 @@ public class PopulateAuditContext extends AbstractProfileAction {
@Override
protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (!super.doPreExecute(profileRequestContext) || fieldExtractors.isEmpty()) {
+ if (!super.doPreExecute(profileRequestContext)) {
return false;
}
@@ -222,6 +240,10 @@ public class PopulateAuditContext extends AbstractProfileAction {
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ if (clearAuditContext) {
+ auditCtx.getFields().clear();
+ }
+
for (final Map.Entry<String,Function<ProfileRequestContext,Object>> entry : fieldExtractors.entrySet()) {
if (!fieldsToExtract.isEmpty() && !fieldsToExtract.contains(entry.getKey())) {
diff --git a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/WriteAuditLog.java b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/WriteAuditLog.java
index 1ae1263b2..5c481465a 100644
--- a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/WriteAuditLog.java
+++ b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/WriteAuditLog.java
@@ -82,6 +82,9 @@ public class WriteAuditLog extends AbstractProfileAction {
/** Convert date/time fields to default time zone. */
private boolean useDefaultTimeZone;
+ /* Include profile's logging ID in category. */
+ private boolean includeProfileLoggingId;
+
/** The Spring RequestContext to operate on. */
@Nullable private RequestContext requestContext;
@@ -94,6 +97,7 @@ public class WriteAuditLog extends AbstractProfileAction {
formattingMap = Collections.emptyMap();
categoriesToLog = Collections.emptyList();
dateTimeFormatter = DateTimeFormatter.ISO_INSTANT;
+ includeProfileLoggingId = true;
}
/**
@@ -220,6 +224,21 @@ public class WriteAuditLog extends AbstractProfileAction {
useDefaultTimeZone = flag;
}
+ /**
+ * Sets whether to suffix the profile's logging ID to the category to log against.
+ *
+ * <p>Defaults to true.</p>
+ *
+ * @param flag flag to set
+ *
+ * @since 4.3.0
+ */
+ public void setIncludeProfileLoggingId(final boolean flag) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ includeProfileLoggingId = flag;
+ }
+
/** {@inheritDoc} */
@Override
protected void doInitialize() throws ComponentInitializationException {
@@ -309,8 +328,14 @@ public class WriteAuditLog extends AbstractProfileAction {
filter(record);
- LoggerFactory.getLogger(entry.getKey() + '.'
- + profileRequestContext.getLoggingId()).info(record.toString());
+ final String category;
+ if (includeProfileLoggingId) {
+ category = entry.getKey() + '.' + profileRequestContext.getLoggingId();
+ } else {
+ category = entry.getKey();
+ }
+
+ LoggerFactory.getLogger(category).info(record.toString());
}
}
// Checkstyle: CyclomaticComplexity ON
diff --git a/idp-profile-impl/src/test/java/net/shibboleth/idp/profile/audit/impl/PopulateAuditContextTest.java b/idp-profile-impl/src/test/java/net/shibboleth/idp/profile/audit/impl/PopulateAuditContextTest.java
index 9c7523d8d..59a77900f 100644
--- a/idp-profile-impl/src/test/java/net/shibboleth/idp/profile/audit/impl/PopulateAuditContextTest.java
+++ b/idp-profile-impl/src/test/java/net/shibboleth/idp/profile/audit/impl/PopulateAuditContextTest.java
@@ -63,14 +63,37 @@ public class PopulateAuditContextTest {
action.setFieldExtractors(map);
action.initialize();
- final Event event = action.execute(src);
+ Event event = action.execute(src);
ActionTestingSupport.assertProceedEvent(event);
- final AuditContext ac = prc.getSubcontext(AuditContext.class);
+ AuditContext ac = prc.getSubcontext(AuditContext.class);
Assert.assertNotNull(ac);
Assert.assertEquals(ac.getFieldValues("a").size(), 1);
Assert.assertEquals(ac.getFieldValues("a").iterator().next(), "foo");
Assert.assertTrue(ac.getFieldValues("b").isEmpty());
+
+ action = new PopulateAuditContext();
+ action.setFieldExtractors(map);
+ action.initialize();
+
+ event = action.execute(src);
+ ActionTestingSupport.assertProceedEvent(event);
+
+ ac = prc.getSubcontext(AuditContext.class);
+ Assert.assertNotNull(ac);
+ Assert.assertEquals(ac.getFieldValues("a").size(), 1);
+ Assert.assertEquals(ac.getFieldValues("a").iterator().next(), "foo");
+
+ action = new PopulateAuditContext();
+ action.setClearAuditContext(true);
+ action.initialize();
+
+ event = action.execute(src);
+ ActionTestingSupport.assertProceedEvent(event);
+
+ ac = prc.getSubcontext(AuditContext.class);
+ Assert.assertNotNull(ac);
+ Assert.assertTrue(ac.getFields().isEmpty());
}
@Test public void testMultiple() throws Exception {
diff --git a/idp-profile-spring/pom.xml b/idp-profile-spring/pom.xml
index 7a5564226..0e2997fe8 100644
--- a/idp-profile-spring/pom.xml
+++ b/idp-profile-spring/pom.xml
@@ -181,10 +181,30 @@
<dependency>
<groupId>${project.groupId}</groupId>
- <artifactId>idp-attribute-filter-spring</artifactId>
+ <artifactId>idp-attribute-resolver-impl</artifactId>
<version>${project.version}</version>
<scope>test</scope>
</dependency>
+ <dependency>
+ <groupId>${project.groupId}</groupId>
+ <artifactId>idp-attribute-resolver-api</artifactId>
+ <version>${project.version}</version>
+ <type>test-jar</type>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${project.groupId}</groupId>
+ <artifactId>idp-attribute-filter-impl</artifactId>
+ <version>${project.version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${project.groupId}</groupId>
+ <artifactId>idp-attribute-filter-api</artifactId>
+ <version>${project.version}</version>
+ <type>test-jar</type>
+ <scope>test</scope>
+ </dependency>
<dependency>
<groupId>net.shibboleth.ext</groupId>
diff --git a/idp-profile-impl/src/test/java/net/shibboleth/idp/profile/impl/FilterAttributesTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/impl/tests/FilterAttributesTest.java
similarity index 99%
rename from idp-profile-impl/src/test/java/net/shibboleth/idp/profile/impl/FilterAttributesTest.java
rename to idp-profile-spring/src/test/java/net/shibboleth/idp/profile/impl/tests/FilterAttributesTest.java
index c05989c5a..bf7329262 100644
--- a/idp-profile-impl/src/test/java/net/shibboleth/idp/profile/impl/FilterAttributesTest.java
+++ b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/impl/tests/FilterAttributesTest.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.profile.impl;
+package net.shibboleth.idp.profile.impl.tests;
import java.util.Arrays;
import java.util.Collections;
@@ -37,6 +37,7 @@ import net.shibboleth.idp.authn.context.SubjectContext;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
+import net.shibboleth.idp.profile.impl.FilterAttributes;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.idp.profile.testing.RequestContextBuilder;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
diff --git a/idp-profile-impl/src/test/java/net/shibboleth/idp/profile/impl/ResolveAttributesTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/impl/tests/ResolveAttributesTest.java
similarity index 99%
rename from idp-profile-impl/src/test/java/net/shibboleth/idp/profile/impl/ResolveAttributesTest.java
rename to idp-profile-spring/src/test/java/net/shibboleth/idp/profile/impl/tests/ResolveAttributesTest.java
index a856c40b2..0b4503499 100644
--- a/idp-profile-impl/src/test/java/net/shibboleth/idp/profile/impl/ResolveAttributesTest.java
+++ b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/impl/tests/ResolveAttributesTest.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.profile.impl;
+package net.shibboleth.idp.profile.impl.tests;
import java.util.Collection;
import java.util.Collections;
@@ -38,6 +38,7 @@ import net.shibboleth.idp.authn.context.SubjectContext;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
+import net.shibboleth.idp.profile.impl.ResolveAttributes;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.idp.profile.testing.RequestContextBuilder;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/impl/tests/package-info.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/impl/tests/package-info.java
new file mode 100644
index 000000000..360adf4f7
--- /dev/null
+++ b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/impl/tests/package-info.java
@@ -0,0 +1,21 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Supplementary test location to fix dependency issues.
+ */
+package net.shibboleth.idp.profile.impl.tests;
\ No newline at end of file
diff --git a/idp-profile-impl/src/test/java/net/shibboleth/idp/relyingparty/impl/DelegatingCriteriaRelyingPartyConfigurationResolverTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/relyingparty/impl/tests/DelegatingCriteriaRelyingPartyConfigurationResolverTest.java
similarity index 98%
rename from idp-profile-impl/src/test/java/net/shibboleth/idp/relyingparty/impl/DelegatingCriteriaRelyingPartyConfigurationResolverTest.java
rename to idp-profile-spring/src/test/java/net/shibboleth/idp/relyingparty/impl/tests/DelegatingCriteriaRelyingPartyConfigurationResolverTest.java
index aa5baa83f..36ed65ab1 100644
--- a/idp-profile-impl/src/test/java/net/shibboleth/idp/relyingparty/impl/DelegatingCriteriaRelyingPartyConfigurationResolverTest.java
+++ b/idp-profile-spring/src/test/java/net/shibboleth/idp/relyingparty/impl/tests/DelegatingCriteriaRelyingPartyConfigurationResolverTest.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.relyingparty.impl;
+package net.shibboleth.idp.relyingparty.impl.tests;
import java.util.Arrays;
import java.util.Collections;
@@ -46,12 +46,15 @@ import org.testng.annotations.Test;
import net.shibboleth.ext.spring.testing.MockApplicationContext;
import net.shibboleth.idp.relyingparty.RelyingPartyConfiguration;
+import net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver;
+import net.shibboleth.idp.relyingparty.impl.DelegatingCriteriaRelyingPartyConfigurationResolver;
import net.shibboleth.idp.saml.relyingparty.impl.RelyingPartyConfigurationSupport;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
/** Unit tests for {@link DelegatingCriteriaRelyingPartyConfigurationResolver}. */
+ at SuppressWarnings("javadoc")
public class DelegatingCriteriaRelyingPartyConfigurationResolverTest extends XMLObjectBaseTestCase {
private RelyingPartyConfiguration anonRP, defaultRP;
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/relyingparty/impl/tests/package-info.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/relyingparty/impl/tests/package-info.java
new file mode 100644
index 000000000..05c241161
--- /dev/null
+++ b/idp-profile-spring/src/test/java/net/shibboleth/idp/relyingparty/impl/tests/package-info.java
@@ -0,0 +1,21 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Supplementary test location to fix dependency issues.
+ */
+package net.shibboleth.idp.relyingparty.impl.tests;
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list