Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add audit logs improvements #396

Merged
merged 2 commits into from
Jul 26, 2023
Merged

Add audit logs improvements #396

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bff5251
Add audit logs improvements
piraveena Jun 22, 2023
c8a2750
fix formatting
chamathns Jul 26, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions components/org.wso2.carbon.identity.sso.saml/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -293,6 +293,11 @@
<artifactId>slf4j-api</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.apache.felix</groupId>
<artifactId>org.apache.felix.scr.ds-annotations</artifactId>
Expand Down
9 changes: 9 additions & 0 deletions ...n.identity.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/SAMLSSOConstants.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -200,6 +200,15 @@ private StatusCodes() {
}
}

/**
* Group the constants related to logs.
*/
public static class LogConstants {

public static final String CREATE_SAML_APPLICATION = "CREATE SAML APPLICATION";
public static final String DELETE_SAML_APPLICATION = "DELETE SAML APPLICATION";
}

public static class SingleLogoutCodes {
public static final String LOGOUT_USER = "urn:oasis:names:tc:SAML:2.0:logout:user";
public static final String LOGOUT_ADMIN = "urn:oasis:names:tc:SAML:2.0:logout:admin";
Expand Down
128 changes: 123 additions & 5 deletions ...ty.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/admin/SAMLSSOConfigAdmin.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,20 +18,25 @@

package org.wso2.carbon.identity.sso.saml.admin;

import com.google.gson.Gson;
import com.google.gson.reflect.TypeToken;
import org.apache.commons.lang.StringUtils;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.opensaml.saml.saml1.core.NameIdentifier;
import org.wso2.carbon.base.MultitenantConstants;
import org.wso2.carbon.context.CarbonContext;
import org.wso2.carbon.core.util.KeyStoreManager;
import org.wso2.carbon.identity.application.authentication.framework.model.AuthenticatedUser;
import org.wso2.carbon.identity.application.mgt.ApplicationMgtUtil;
import org.wso2.carbon.identity.base.IdentityException;
import org.wso2.carbon.identity.core.model.SAMLSSOServiceProviderDO;
import org.wso2.carbon.identity.core.util.IdentityTenantUtil;
import org.wso2.carbon.identity.core.util.IdentityUtil;
import org.wso2.carbon.identity.sp.metadata.saml2.exception.InvalidMetadataException;
import org.wso2.carbon.identity.sp.metadata.saml2.util.Parser;
import org.wso2.carbon.identity.sso.saml.Error;
import org.wso2.carbon.identity.sso.saml.SAMLSSOConstants;
import org.wso2.carbon.identity.sso.saml.SSOServiceProviderConfigManager;
import org.wso2.carbon.identity.sso.saml.dto.SAMLSSOServiceProviderDTO;
import org.wso2.carbon.identity.sso.saml.dto.SAMLSSOServiceProviderInfoDTO;
Expand All @@ -41,10 +46,18 @@
import org.wso2.carbon.identity.sso.saml.util.SAMLSSOUtil;
import org.wso2.carbon.registry.core.Registry;
import org.wso2.carbon.registry.core.session.UserRegistry;
import org.wso2.carbon.user.core.util.UserCoreUtil;
import org.wso2.carbon.utils.AuditLog;

import java.security.KeyStore;
import java.security.cert.CertificateException;
import java.util.HashMap;
import java.util.Map;
import java.util.Optional;

import static org.wso2.carbon.identity.application.authentication.framework.util.FrameworkConstants.LogConstants.USER;
import static org.wso2.carbon.identity.application.mgt.ApplicationConstants.LogConstants.TARGET_APPLICATION;
import static org.wso2.carbon.identity.central.log.mgt.utils.LoggerUtils.triggerAuditLogEvent;
import static org.wso2.carbon.identity.sso.saml.Error.CONFLICTING_SAML_ISSUER;
import static org.wso2.carbon.identity.sso.saml.Error.INVALID_REQUEST;

Expand Down Expand Up @@ -86,8 +99,22 @@ public boolean addRelyingPartyServiceProvider(SAMLSSOServiceProviderDTO serviceP
log.error(message);
return false;
}
return IdentitySAMLSSOServiceComponentHolder.getInstance().getSAMLSSOServiceProviderManager()
boolean isSuccess = IdentitySAMLSSOServiceComponentHolder.getInstance().getSAMLSSOServiceProviderManager()
.addServiceProvider(serviceProviderDO, tenantId);
if (isSuccess && ApplicationMgtUtil.isLegacyAuditLogsDisabledInAppMgt()) {
Optional<String> initiatorId = getInitiatorId();
if (initiatorId.isPresent()) {
AuditLog.AuditLogBuilder auditLogBuilder = new AuditLog.AuditLogBuilder(
initiatorId.get(), USER,
issuer, TARGET_APPLICATION,
SAMLSSOConstants.LogConstants.CREATE_SAML_APPLICATION)
.data(buildSPData(serviceProviderDO));
triggerAuditLogEvent(auditLogBuilder, true);
} else {
log.error("Error getting the logged in userId");
}
}
return isSuccess;
} catch (IdentityException e) {
String message = "Error obtaining a registry for adding a new service provider";
throw new IdentityException(message, e);
Expand Down Expand Up @@ -140,7 +167,21 @@ public SAMLSSOServiceProviderDTO addSAMLServiceProvider(SAMLSSOServiceProviderDT
String message = "A Service Provider with the name: " + issuer + " is already loaded from the file system.";
throw buildClientException(CONFLICTING_SAML_ISSUER, message);
}
return persistSAMLServiceProvider(serviceProviderDO);
SAMLSSOServiceProviderDTO samlssoServiceProviderDTO = persistSAMLServiceProvider(serviceProviderDO);
if (ApplicationMgtUtil.isLegacyAuditLogsDisabledInAppMgt()) {
Optional<String> initiatorId = getInitiatorId();
if (initiatorId.isPresent()) {
AuditLog.AuditLogBuilder auditLogBuilder = new AuditLog.AuditLogBuilder(
initiatorId.get(), USER,
issuer, TARGET_APPLICATION,
SAMLSSOConstants.LogConstants.CREATE_SAML_APPLICATION)
.data(buildSPData(serviceProviderDO));
triggerAuditLogEvent(auditLogBuilder, true);
} else {
log.error("Error getting the logged in userId");
}
}
return samlssoServiceProviderDTO;
} catch (IdentitySAML2ClientException e){
throw e;
} catch (IdentityException e) {
Expand All @@ -149,6 +190,47 @@ public SAMLSSOServiceProviderDTO addSAMLServiceProvider(SAMLSSOServiceProviderDT
}
}

private static Map<String, Object> buildSPData(SAMLSSOServiceProviderDO app) {

if (app == null) {
return new HashMap<>();
}

Gson gson = new Gson();
String json = gson.toJson(app);
return gson.fromJson(json, new TypeToken<Map<String, Object>>() {
}.getType());
}

/**
* This method is used to retrieve logged in tenant domain.
* @return logged in tenant domain.
*/
private String getLoggedInTenantDomain() {

if (!IdentityTenantUtil.isTenantedSessionsEnabled()) {
return getTenantDomain();
}
return IdentityTenantUtil.getTenantDomainFromContext();
}

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

private Optional<AuthenticatedUser> getLoggedInUser(String tenantDomain) {

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

String tenantAwareLoggedInUsername = CarbonContext.getThreadLocalCarbonContext().getUsername();
return Optional.ofNullable(tenantAwareLoggedInUsername)
.filter(StringUtils::isNotEmpty)
.map(username -> buildAuthenticatedUser(username, tenantDomain));
}

private AuthenticatedUser buildAuthenticatedUser(String tenantAwareUser, String tenantDomain) {

AuthenticatedUser user = new AuthenticatedUser();
user.setUserName(UserCoreUtil.removeDomainFromName(tenantAwareUser));
user.setTenantDomain(tenantDomain);
user.setUserStoreDomain(IdentityUtil.extractDomainFromName(tenantAwareUser));
return user;
}

/**
* Update a service provider if it exists.
*
Expand Down Expand Up @@ -283,8 +365,21 @@ public SAMLSSOServiceProviderDTO uploadRelyingPartyServiceProvider(String metada
throw new IdentityException("Error occurred while setting certificate and alias", e);
}
}

return persistSAMLServiceProvider(samlssoServiceProviderDO);
SAMLSSOServiceProviderDTO samlssoServiceProviderDTO = persistSAMLServiceProvider(samlssoServiceProviderDO);
if (ApplicationMgtUtil.isLegacyAuditLogsDisabledInAppMgt()) {
Optional<String> initiatorId = getInitiatorId();
if (initiatorId.isPresent()) {
AuditLog.AuditLogBuilder auditLogBuilder = new AuditLog.AuditLogBuilder(
initiatorId.get(), USER,
samlssoServiceProviderDO.getIssuer(), TARGET_APPLICATION,
SAMLSSOConstants.LogConstants.CREATE_SAML_APPLICATION)
.data(buildSPData(samlssoServiceProviderDO));
triggerAuditLogEvent(auditLogBuilder, true);
} else {
log.error("Error getting the logged in userId");
}
}
return samlssoServiceProviderDTO;
}

/**
Expand Down Expand Up @@ -599,13 +694,36 @@ public SAMLSSOServiceProviderInfoDTO getServiceProviders() throws IdentityExcept
*/
public boolean removeServiceProvider(String issuer) throws IdentityException {
try {
return IdentitySAMLSSOServiceComponentHolder.getInstance()
boolean isSuccess = IdentitySAMLSSOServiceComponentHolder.getInstance()
.getSAMLSSOServiceProviderManager().removeServiceProvider(issuer, tenantId);
if (isSuccess) {
if (ApplicationMgtUtil.isLegacyAuditLogsDisabledInAppMgt()) {
Optional<String> initiatorId = getInitiatorId();
if (initiatorId.isPresent()) {
AuditLog.AuditLogBuilder auditLogBuilder = new AuditLog.AuditLogBuilder(initiatorId.get(),
USER, issuer, TARGET_APPLICATION,
SAMLSSOConstants.LogConstants.DELETE_SAML_APPLICATION);
triggerAuditLogEvent(auditLogBuilder, true);
} else {
log.error("Error getting the logged in userId");
}
}
}
return isSuccess;
} catch (IdentityException e) {
throw new IdentityException("Error removing a Service Provider with issuer: " + issuer, e);
}
}

private Optional<String> getInitiatorId() {

return Optional.ofNullable(CarbonContext.getThreadLocalCarbonContext().getUserId())
.filter(StringUtils::isNotBlank)
.or(() -> getLoggedInUser(getLoggedInTenantDomain())
.map(loggedInUser -> IdentityUtil.getInitiatorId(loggedInUser.getUserName(),
getLoggedInTenantDomain())));
}

protected String getTenantDomain() {

return CarbonContext.getThreadLocalCarbonContext().getTenantDomain();
Expand Down
10 changes: 8 additions & 2 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -261,6 +261,11 @@
<artifactId>axis2-client</artifactId>
<version>${axis2.wso2.version}</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>${com.fasterxml.jackson.version}</version>
</dependency>
<dependency>
<groupId>org.wso2.carbon.identity.inbound.auth.saml2</groupId>
<artifactId>org.wso2.carbon.identity.sso.saml.common</artifactId>
Expand Down Expand Up @@ -450,9 +455,9 @@
</modules>

<properties>
<carbon.kernel.version>4.9.0</carbon.kernel.version>
<carbon.kernel.version>4.9.10</carbon.kernel.version>
<carbon.kernel.feature.version>4.9.0</carbon.kernel.feature.version>
<carbon.identity.framework.version>5.25.247</carbon.identity.framework.version>
<carbon.identity.framework.version>5.25.258</carbon.identity.framework.version>
<carbon.identity.framework.imp.pkg.version.range>[5.25.234, 7.0.0)
</carbon.identity.framework.imp.pkg.version.range>
<carbon.identity.organization.management.core.version>1.0.0</carbon.identity.organization.management.core.version>
Expand All @@ -470,6 +475,7 @@
<encoder.wso2.version>1.2.0.wso2v1</encoder.wso2.version>
<axis2.wso2.version>1.6.1.wso2v12</axis2.wso2.version>
<joda.wso2.version>2.9.4.wso2v1</joda.wso2.version>
<com.fasterxml.jackson.version>2.13.2</com.fasterxml.jackson.version>

<maven.bundle.plugin.version>3.2.0</maven.bundle.plugin.version>
<maven.compiler.plugin.version>2.3.1</maven.compiler.plugin.version>
Expand Down
Loading