[java-identity-provider] 04/11: IDP-2039 - Add audit logging to login flows

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=56a26c291539d75fdb89f4ba9a21b9cc953288ff

commit 56a26c291539d75fdb89f4ba9a21b9cc953288ff
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Dec 6 14:30:03 2022 -0500

    IDP-2039 - Add audit logging to login flows
    
    https://shibboleth.atlassian.net/browse/IDP-2039
    
    Audit IPAddress flow.
---
 .../idp/authn/impl/ValidateUserAgentAddress.java   | 20 ++++++---
 .../idp/flows/authn/ipaddress-authn-beans.xml      | 50 +++++++++++++++++++++-
 2 files changed, 64 insertions(+), 6 deletions(-)

diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUserAgentAddress.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUserAgentAddress.java
index 10725d5be..1afd33417 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUserAgentAddress.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUserAgentAddress.java
@@ -34,17 +34,17 @@ import org.opensaml.profile.context.ProfileRequestContext;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import com.google.common.base.Strings;
-
-import net.shibboleth.idp.authn.AbstractValidationAction;
 import net.shibboleth.idp.authn.AuthnEventIds;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.authn.context.UserAgentContext;
 import net.shibboleth.idp.authn.principal.UsernamePrincipal;
+import net.shibboleth.idp.profile.IdPAuditFields;
 import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.net.IPRange;
 
+import com.google.common.base.Strings;
+
 /**
  * An action that ensures that a user-agent address found within a {@link UserAgentContext}
  * is within a given range and generates an {@link net.shibboleth.idp.authn.AuthenticationResult}.
@@ -57,7 +57,7 @@ import net.shibboleth.shared.net.IPRange;
  * satisfies a configured address range, an {@link net.shibboleth.idp.authn.AuthenticationResult} is saved to the
  * {@link AuthenticationContext}.
  */
-public class ValidateUserAgentAddress extends AbstractValidationAction {
+public class ValidateUserAgentAddress extends AbstractAuditingValidationAction {
 
     /** Default prefix for metrics. */
     @Nonnull @NotEmpty private static final String DEFAULT_METRIC_NAME = "net.shibboleth.idp.authn.address";
@@ -174,4 +174,14 @@ public class ValidateUserAgentAddress extends AbstractValidationAction {
         return subject;
     }
 
-}
\ No newline at end of file
+    /** {@inheritDoc} */
+    @Override
+    @Nullable protected Map<String, String> getAuditFields(@Nonnull final ProfileRequestContext profileRequestContext) {
+        if (principalName != null) {
+            return Map.of(IdPAuditFields.USERNAME, principalName);
+        }
+        
+        return super.getAuditFields(profileRequestContext);
+    }
+
+}
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/ipaddress-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/ipaddress-authn-beans.xml
index 85094bccf..81c2894fb 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/ipaddress-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/ipaddress-authn-beans.xml
@@ -18,6 +18,25 @@
     <bean class="net.shibboleth.shared.spring.config.IdentifiableBeanPostProcessor" />
     <bean class="net.shibboleth.idp.profile.impl.ProfileActionBeanPostProcessor" />
 
+    <!-- Default message map. -->
+    <util:map id="shibboleth.authn.IPAddress.ClassifiedMessageMap">
+        <entry key="RequestUnsupported">
+            <list>
+                <value>RequestUnsupported</value>
+            </list>
+        </entry>
+        <entry key="NoCredentials">
+            <list>
+                <value>NoCredentials</value>
+            </list>
+        </entry>
+        <entry key="InvalidCredentials">
+            <list>
+                <value>InvalidCredentials</value>
+            </list>
+        </entry>
+    </util:map>
+
     <import resource="conditional:%{idp.home}/conf/authn/ipaddress-authn-config.xml" />
     
     <bean id="ExtractUserAgentAddress" class="net.shibboleth.idp.authn.impl.ExtractUserAgentAddress" scope="prototype"
@@ -27,11 +46,40 @@
         
     <bean id="ValidateUserAgentAddress" class="net.shibboleth.idp.authn.impl.ValidateUserAgentAddress" scope="prototype"
         p:mappings="#{getObject('shibboleth.authn.IPAddress.Mappings')}"
+        p:classifiedMessages="#{getObject('shibboleth.authn.IPAddress.ClassifiedMessageMap')}"
         p:addDefaultPrincipals="#{getObject('shibboleth.authn.IPAddress.addDefaultPrincipals') ?: %{idp.authn.IPAddress.addDefaultPrincipals:true}}"
-        p:resultCachingPredicate="#{getObject('shibboleth.authn.IPAddress.resultCachingPredicate')}" />
+        p:resultCachingPredicate="#{getObject('shibboleth.authn.IPAddress.resultCachingPredicate')}"
+        p:populateAuditContextAction="#{%{idp.authn.IPAddress.audit.enabled:%{idp.authn.audit.enabled:false}} ? getObject('shibboleth.authn.IPAddress.PopulateAuditContext') : null}"
+        p:writeAuditLogAction="#{%{idp.authn.IPAddress.audit.enabled:%{idp.authn.audit.enabled:false}} ? getObject('WriteAuditLog') : null}" />
 
     <bean id="PopulateSubjectCanonicalizationContext"
         class="net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext" scope="prototype"
         p:availableFlows-ref="shibboleth.PostLoginSubjectCanonicalizationFlows" />
 
+    <!-- Audit logging beans. -->
+
+    <!-- Default audit format and extractors --> 
+    <util:map id="shibboleth.authn.AuditFormattingMap">
+        <entry key="#{'%{idp.authn.IPAddress.audit.category:Shibboleth-Audit.IPAddress}'.trim()}"
+            value="#{'%{idp.authn.IPAddress.audit.format:%a|%T|%SP|%s|%AF|%CV|%u|%AR|%UA}'.trim()}" />
+    </util:map>
+
+    <bean id="shibboleth.authn.IPAddress.DefaultAuditExtractors" parent="shibboleth.authn.DefaulAuditExtractors" lazy-init="true"
+            class="org.springframework.beans.factory.config.MapFactoryBean">
+        <property name="sourceMap">
+             <map merge="true">
+                <entry>
+                    <key>
+                        <util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.USERNAME"/>
+                    </key>
+                    <bean class="net.shibboleth.idp.authn.audit.impl.AttemptedUsernameAuditExtractor" />
+                </entry>
+             </map>
+        </property>
+    </bean>
+    
+    <bean id="shibboleth.authn.IPAddress.PopulateAuditContext" parent="shibboleth.authn.AbstractPopulateAuditContext" lazy-init="true"
+        p:fieldExtractors="#{getObject('shibboleth.authn.IPAddress.AuditExtractors') ?: getObject('shibboleth.authn.IPAddress.DefaultAuditExtractors')}"
+        p:clearAuditContext="true" />
+
 </beans>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.