Attached please find the patch for ticket 1006:
https://fedorahosted.org/pki/ticket/1006 Audit logging for TPS REST
operations
Most of the work is on
1. finding the right places to place the audit calls
2. deciding on what should be audited: since all read operations are
captured by AUTZ, the REST operations audited are only write operations
3. deciding on the audit events that should be provided for the operations
4. making needed information available at the places where auditing is
happening
thanks
Christina
From b739dd8935499e833655be5d05a8002df07cc8e9 Mon Sep 17 00:00:00 2001
From: Christina Fu
Date: Thu, 24 Mar 2016 16:23:05 -0700
Subject: [PATCH] Ticket #1006 Audit logging for TPS REST operations
---
.../src/com/netscape/certsrv/logging/IAuditor.java | 3 +-
.../com/netscape/cms/servlet/base/PKIService.java | 15 ++
.../org/dogtagpki/server/rest/AuditService.java| 117 ++--
base/server/cmsbundle/src/LogMessages.properties | 55 +++-
.../src/com/netscape/cmscore/logging/Auditor.java | 19 +-
base/tps/shared/conf/CS.cfg.in | 4 +-
.../dogtagpki/server/tps/config/ConfigService.java | 30 ++-
.../server/tps/rest/AuthenticatorService.java | 187 ++---
.../server/tps/rest/ConnectorService.java | 180 ++---
.../server/tps/rest/ProfileMappingService.java | 157 +--
.../dogtagpki/server/tps/rest/ProfileService.java | 171 ++--
.../dogtagpki/server/tps/rest/TokenService.java| 297 +
12 files changed, 1028 insertions(+), 207 deletions(-)
diff --git a/base/common/src/com/netscape/certsrv/logging/IAuditor.java b/base/common/src/com/netscape/certsrv/logging/IAuditor.java
index a9362259633e29d33f5ae8fc3efc86628c9ebe35..89c03b838ca2e546224bfd2b3785c6684b59aeed 100644
--- a/base/common/src/com/netscape/certsrv/logging/IAuditor.java
+++ b/base/common/src/com/netscape/certsrv/logging/IAuditor.java
@@ -70,9 +70,10 @@ public interface IAuditor {
* @return a delimited string of one or more delimited name/value pairs
*/
public String getParamString(String scope, String type, String id, Map params);
+public String getParamString(StringBuilder paramsters, Map params);
/**
* Log audit message.
*/
public void log(String message);
-}
\ No newline at end of file
+}
diff --git a/base/server/cms/src/com/netscape/cms/servlet/base/PKIService.java b/base/server/cms/src/com/netscape/cms/servlet/base/PKIService.java
index d2e55b5a3c42ee89f5784da12de860fd4e8880bf..7ed9c0dc86b08add5066a9c6df29ce791775e54e 100644
--- a/base/server/cms/src/com/netscape/cms/servlet/base/PKIService.java
+++ b/base/server/cms/src/com/netscape/cms/servlet/base/PKIService.java
@@ -259,6 +259,21 @@ public class PKIService {
auditor.log(auditMessage);
}
+public void auditConfigTokenGeneral(String status, String service, Map params, String info) {
+CMS.debug("PKIService.auditConfigTokenGeneral begins");
+
+String msg = CMS.getLogMessage(
+"LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_GENERAL_5",
+servletRequest.getUserPrincipal().getName(),
+status,
+service,
+auditor.getParamString(null, params),
+info);
+auditor.log(msg);
+
+CMS.debug("PKIService.auditConfigTokenGeneral ends");
+}
+
/**
* Get the values of the fields annotated with @FormParam.
*/
diff --git a/base/server/cms/src/org/dogtagpki/server/rest/AuditService.java b/base/server/cms/src/org/dogtagpki/server/rest/AuditService.java
index e32c36c3313e8bbb3ea729245dcd51d5f2fda7a7..273625e81776ab8a8cd024f503f5e45ade94612a 100644
--- a/base/server/cms/src/org/dogtagpki/server/rest/AuditService.java
+++ b/base/server/cms/src/org/dogtagpki/server/rest/AuditService.java
@@ -21,6 +21,7 @@ package org.dogtagpki.server.rest;
import java.io.UnsupportedEncodingException;
import java.net.URI;
import java.util.Collection;
+import java.util.HashMap;
import java.util.Map;
import java.util.TreeMap;
import java.util.TreeSet;
@@ -42,6 +43,7 @@ import com.netscape.certsrv.base.IConfigStore;
import com.netscape.certsrv.base.PKIException;
import com.netscape.certsrv.logging.AuditConfig;
import com.netscape.certsrv.logging.AuditResource;
+import com.netscape.certsrv.logging.ILogger;
import com.netscape.cms.servlet.base.PKIService;
/**
@@ -66,29 +68,62 @@ public class AuditService extends PKIService implements AuditResource {
}
public AuditConfig createAuditConfig() throws UnsupportedEncodingException, EBaseException {
+return createAuditConfig(null);
+}
+
+public AuditConfig createAuditConfig(Map auditParams)
+throws UnsupportedEncodingException, EBaseException {
IConfigStore cs = CMS.getConfigStore();
AuditConfig auditConfig = new AuditConfig();
-auditConfig.setStatus(cs.getBoolean("log.instance.SignedAudit.enable", false
