[java-identity-provider] branch main updated: IDP-2039 - Add audit logging to login flows
Scott Cantor
cantor.2 at osu.edu
Tue Jan 3 21:41:05 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=815ecc42997e54a9cc5239a88c130411f6277e8a
The following commit(s) were added to refs/heads/main by this push:
new 815ecc429 IDP-2039 - Add audit logging to login flows
815ecc429 is described below
commit 815ecc42997e54a9cc5239a88c130411f6277e8a
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jan 3 16:41:02 2023 -0500
IDP-2039 - Add audit logging to login flows
https://shibboleth.atlassian.net/browse/IDP-2039
Initial refactor of logging actions and POM adjustments.
Cycle-causing tests moved to idp-saml-impl.
Ported up from maint-4 branch.
---
idp-profile-impl/pom.xml | 22 -----------------
.../profile/audit/impl/PopulateAuditContext.java | 23 +++++++++++++++++-
.../idp/profile/audit/impl/WriteAuditLog.java | 28 ++++++++++++++++++++--
idp-saml-impl/pom.xml | 22 +++++++++++++++++
.../profile/impl/tests}/FilterAttributesTest.java | 3 ++-
.../profile/impl/tests}/ResolveAttributesTest.java | 3 ++-
...teriaRelyingPartyConfigurationResolverTest.java | 5 ++--
7 files changed, 77 insertions(+), 29 deletions(-)
diff --git a/idp-profile-impl/pom.xml b/idp-profile-impl/pom.xml
index 5e8da4fad..f2e55b043 100644
--- a/idp-profile-impl/pom.xml
+++ b/idp-profile-impl/pom.xml
@@ -111,12 +111,6 @@
<!-- Runtime Dependencies -->
<!-- Test Dependencies -->
- <dependency>
- <groupId>${project.groupId}</groupId>
- <artifactId>idp-saml-impl</artifactId>
- <version>${project.version}</version>
- <scope>test</scope>
- </dependency>
<dependency>
<groupId>${project.groupId}</groupId>
<artifactId>idp-testing</artifactId>
@@ -124,22 +118,6 @@
<scope>test</scope>
</dependency>
- <dependency>
- <groupId>net.shibboleth</groupId>
- <artifactId>shib-attribute-filter-impl</artifactId>
- <scope>test</scope>
- </dependency>
- <dependency>
- <groupId>net.shibboleth</groupId>
- <artifactId>shib-attribute-resolver-impl</artifactId>
- <scope>test</scope>
- </dependency>
- <dependency>
- <groupId>net.shibboleth</groupId>
- <artifactId>shib-attribute-testing</artifactId>
- <scope>test</scope>
- </dependency>
-
<dependency>
<groupId>${opensaml.groupId}</groupId>
<artifactId>opensaml-storage-impl</artifactId>
diff --git a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/PopulateAuditContext.java b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/PopulateAuditContext.java
index 097d403bd..d7ee424cf 100644
--- a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/PopulateAuditContext.java
+++ b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/PopulateAuditContext.java
@@ -86,6 +86,9 @@ public class PopulateAuditContext extends AbstractProfileAction {
/** Convert date/time fields to default time zone. */
private boolean useDefaultTimeZone;
+ /** Flag signalling to clear context on entry. */
+ private boolean clearAuditContext;
+
/** {@link AuditContext} to populate. */
@Nullable private AuditContext auditCtx;
@@ -183,6 +186,20 @@ public class PopulateAuditContext extends AbstractProfileAction {
useDefaultTimeZone = flag;
}
+ /**
+ * Sets whether to clear any existing fields from the audit context.
+ *
+ * <p>Defaults to false.</p>
+ *
+ * @param flag flag to set
+ *
+ * @since 4.3.0
+ */
+ public void setClearAuditContext(final boolean flag) {
+ checkSetterPreconditions();
+ clearAuditContext = flag;
+ }
+
/** {@inheritDoc} */
@Override
protected void doInitialize() throws ComponentInitializationException {
@@ -199,7 +216,7 @@ public class PopulateAuditContext extends AbstractProfileAction {
@Override
protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (!super.doPreExecute(profileRequestContext) || fieldExtractors.isEmpty()) {
+ if (!super.doPreExecute(profileRequestContext)) {
return false;
}
@@ -217,6 +234,10 @@ public class PopulateAuditContext extends AbstractProfileAction {
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ if (clearAuditContext) {
+ auditCtx.getFields().clear();
+ }
+
for (final Map.Entry<String,Function<ProfileRequestContext,Object>> entry : fieldExtractors.entrySet()) {
if (!fieldsToExtract.isEmpty() && !fieldsToExtract.contains(entry.getKey())) {
diff --git a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/WriteAuditLog.java b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/WriteAuditLog.java
index 603a980b8..1baa929bc 100644
--- a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/WriteAuditLog.java
+++ b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/WriteAuditLog.java
@@ -79,6 +79,9 @@ public class WriteAuditLog extends AbstractProfileAction {
/** Convert date/time fields to default time zone. */
private boolean useDefaultTimeZone;
+ /* Include profile's logging ID in category. */
+ private boolean includeProfileLoggingId;
+
/** The Spring RequestContext to operate on. */
@Nullable private RequestContext requestContext;
@@ -91,6 +94,7 @@ public class WriteAuditLog extends AbstractProfileAction {
formattingMap = Collections.emptyMap();
categoriesToLog = Collections.emptyList();
dateTimeFormatter = DateTimeFormatter.ISO_INSTANT;
+ includeProfileLoggingId = true;
}
/**
@@ -214,6 +218,20 @@ public class WriteAuditLog extends AbstractProfileAction {
useDefaultTimeZone = flag;
}
+ /**
+ * Sets whether to suffix the profile's logging ID to the category to log against.
+ *
+ * <p>Defaults to true.</p>
+ *
+ * @param flag flag to set
+ *
+ * @since 4.3.0
+ */
+ public void setIncludeProfileLoggingId(final boolean flag) {
+ checkSetterPreconditions();
+ includeProfileLoggingId = flag;
+ }
+
/** {@inheritDoc} */
@Override
protected void doInitialize() throws ComponentInitializationException {
@@ -303,8 +321,14 @@ public class WriteAuditLog extends AbstractProfileAction {
filter(record);
- LoggerFactory.getLogger(entry.getKey() + '.'
- + profileRequestContext.getLoggingId()).info(record.toString());
+ final String category;
+ if (includeProfileLoggingId) {
+ category = entry.getKey() + '.' + profileRequestContext.getLoggingId();
+ } else {
+ category = entry.getKey();
+ }
+
+ LoggerFactory.getLogger(category).info(record.toString());
}
}
// Checkstyle: CyclomaticComplexity ON
diff --git a/idp-saml-impl/pom.xml b/idp-saml-impl/pom.xml
index 4679a464e..621770eda 100644
--- a/idp-saml-impl/pom.xml
+++ b/idp-saml-impl/pom.xml
@@ -165,6 +165,12 @@
</dependency>
<!-- Test Dependencies -->
+ <dependency>
+ <groupId>${project.groupId}</groupId>
+ <artifactId>idp-profile-impl</artifactId>
+ <version>${project.version}</version>
+ <scope>test</scope>
+ </dependency>
<dependency>
<groupId>${project.groupId}</groupId>
<artifactId>idp-session-impl</artifactId>
@@ -178,6 +184,22 @@
<scope>test</scope>
</dependency>
+ <dependency>
+ <groupId>net.shibboleth</groupId>
+ <artifactId>shib-attribute-testing</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>net.shibboleth</groupId>
+ <artifactId>shib-attribute-filter-impl</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>net.shibboleth</groupId>
+ <artifactId>shib-attribute-resolver-impl</artifactId>
+ <scope>test</scope>
+ </dependency>
+
<dependency>
<groupId>${opensaml.groupId}</groupId>
<artifactId>opensaml-core-impl</artifactId>
diff --git a/idp-profile-impl/src/test/java/net/shibboleth/idp/profile/impl/FilterAttributesTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/profile/impl/tests/FilterAttributesTest.java
similarity index 99%
rename from idp-profile-impl/src/test/java/net/shibboleth/idp/profile/impl/FilterAttributesTest.java
rename to idp-saml-impl/src/test/java/net/shibboleth/idp/profile/impl/tests/FilterAttributesTest.java
index 419f66334..61afd5b5b 100644
--- a/idp-profile-impl/src/test/java/net/shibboleth/idp/profile/impl/FilterAttributesTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/profile/impl/tests/FilterAttributesTest.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.profile.impl;
+package net.shibboleth.idp.profile.impl.tests;
import java.util.Arrays;
import java.util.Collections;
@@ -36,6 +36,7 @@ import net.shibboleth.idp.authn.context.SubjectContext;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
+import net.shibboleth.idp.profile.impl.FilterAttributes;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.idp.profile.testing.RequestContextBuilder;
import net.shibboleth.shared.component.ComponentInitializationException;
diff --git a/idp-profile-impl/src/test/java/net/shibboleth/idp/profile/impl/ResolveAttributesTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/profile/impl/tests/ResolveAttributesTest.java
similarity index 98%
rename from idp-profile-impl/src/test/java/net/shibboleth/idp/profile/impl/ResolveAttributesTest.java
rename to idp-saml-impl/src/test/java/net/shibboleth/idp/profile/impl/tests/ResolveAttributesTest.java
index 246b94051..1a955b9f6 100644
--- a/idp-profile-impl/src/test/java/net/shibboleth/idp/profile/impl/ResolveAttributesTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/profile/impl/tests/ResolveAttributesTest.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.profile.impl;
+package net.shibboleth.idp.profile.impl.tests;
import java.util.Collection;
import java.util.Collections;
@@ -37,6 +37,7 @@ import net.shibboleth.idp.authn.context.SubjectContext;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
+import net.shibboleth.idp.profile.impl.ResolveAttributes;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.idp.profile.testing.RequestContextBuilder;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
diff --git a/idp-profile-impl/src/test/java/net/shibboleth/idp/relyingparty/impl/DelegatingCriteriaRelyingPartyConfigurationResolverTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/relyingparty/impl/tests/DelegatingCriteriaRelyingPartyConfigurationResolverTest.java
similarity index 98%
rename from idp-profile-impl/src/test/java/net/shibboleth/idp/relyingparty/impl/DelegatingCriteriaRelyingPartyConfigurationResolverTest.java
rename to idp-saml-impl/src/test/java/net/shibboleth/idp/relyingparty/impl/tests/DelegatingCriteriaRelyingPartyConfigurationResolverTest.java
index 1ea5a1618..ecaac6db1 100644
--- a/idp-profile-impl/src/test/java/net/shibboleth/idp/relyingparty/impl/DelegatingCriteriaRelyingPartyConfigurationResolverTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/relyingparty/impl/tests/DelegatingCriteriaRelyingPartyConfigurationResolverTest.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.relyingparty.impl;
+package net.shibboleth.idp.relyingparty.impl.tests;
import java.util.Arrays;
import java.util.Collections;
@@ -45,11 +45,12 @@ import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
import net.shibboleth.idp.relyingparty.RelyingPartyConfiguration;
+import net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver;
+import net.shibboleth.idp.relyingparty.impl.DelegatingCriteriaRelyingPartyConfigurationResolver;
import net.shibboleth.idp.saml.relyingparty.impl.RelyingPartyConfigurationSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
-import net.shibboleth.shared.testing.MockApplicationContext;
/** Unit tests for {@link DelegatingCriteriaRelyingPartyConfigurationResolver}. */
public class DelegatingCriteriaRelyingPartyConfigurationResolverTest extends XMLObjectBaseTestCase {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list