[JIRA] (JDUO-65) Align audit logging to delivered feature in IdP

[Philip Smart (Jira)]

Philip Smart ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5afecdc1eb3ffa0c596652c4 ) *commented* on JDUO-65 ( https://shibboleth.atlassian.net/browse/JDUO-65?atlOrigin=eyJpIjoiMjU4NWU4ZjM5OGZhNDZhOGEzN2M1M2Q1YmQ2ZWYxYmMiLCJwIjoiaiJ9 )

Re: Align audit logging to delivered feature in IdP ( https://shibboleth.atlassian.net/browse/JDUO-65?atlOrigin=eyJpIjoiMjU4NWU4ZjM5OGZhNDZhOGEzN2M1M2Q1YmQ2ZWYxYmMiLCJwIjoiaiJ9 )

So far I have:

* Switched the ValidateDuoTokenAuthenticationResult to be a subtype of the new AbstractAuditingValidationAction action
* Moved the final PostDuoPopulateAuditContext and WriteAuditLog actions into the validation action that uses the authn-wide WriteAuthnAuditLog.
* Configured the DuoOIDC shibboleth.authn.AuditFormattingMap to use the existing default Duo audit format, and included the property override idp.duo.oidc.audit.format.
* Moved all the audit context population beans to be subtypes of the authn-wide shibboleth.authn.AbstractPopulateAuditContext.
* I’ve deprecated some of the Duo AuditField constants in duo-impl in favour of those new ones in the IdP AuthnAuditFields —The format is still compatible.
* Added a property for the category ( idp.duo.oidc.audit.category ) which by default is the same as the existing audit category.

This all seems in line with what exists for the 4.3.0 authn audit implementation. The only difference on upgrade should be the need to switch on the global authentication audit mechanism via idp.authn.audit.enabled.

There was one difference:

* DuoOIDC logs before the Duo 2FA redirect in addition to at the end during validation. So I kept the pre-duo-redirect audit context population stage (but using the new parent beans) and wired the flow directly into the WriteAuthnAuditLog.

* This works fine but does not respect the idp.duo.oidc.audit.enabled property as the AbstractAuditingValidationAction does.
* So, I introduced a WritePreDuoAuthnAuditLog into the DuoOIDC authn beans context (child of the WriteAuthnAuditLog) which overrides and sets the activation condition based on both idp.authn.audit.enabled and idp.duo.oidc.audit.enabled. In other words, it turns on and off like the validation audit logging.

* I think this is fine. I am not sure of another way to do that.

( https://shibboleth.atlassian.net/browse/JDUO-65#add-comment?atlOrigin=eyJpIjoiMjU4NWU4ZjM5OGZhNDZhOGEzN2M1M2Q1YmQ2ZWYxYmMiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JDUO-65#add-comment?atlOrigin=eyJpIjoiMjU4NWU4ZjM5OGZhNDZhOGEzN2M1M2Q1YmQ2ZWYxYmMiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100216- sha1:a0b8fe5 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230216/51f68e95/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-64e50ce2-0edf-4bff-8fcd-3afd5980b31f
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230216/51f68e95/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-d3821dcf-923e-4d5c-acb3-38f74c0fb364
Type: image/png
Size: 448 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230216/51f68e95/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-3c8bee82-bda4-45e2-b66d-222685c2e6ec
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230216/51f68e95/attachment-0005.png>