[Jboss-cvs] JBossAS SVN: r56157 - trunk/server/src/main/org/jboss/ejb/plugins

[jboss-cvs-commits at lists.jboss.org]

Author: anil.saldhana at jboss.com
Date: 2006-08-22 16:14:41 -0400 (Tue, 22 Aug 2006)
New Revision: 56157

Modified:
   trunk/server/src/main/org/jboss/ejb/plugins/SecurityInterceptor.java
Log:
JBAS-2738: EJB security interceptor supports audit

Modified: trunk/server/src/main/org/jboss/ejb/plugins/SecurityInterceptor.java
===================================================================
--- trunk/server/src/main/org/jboss/ejb/plugins/SecurityInterceptor.java	2006-08-22 20:14:21 UTC (rev 56156)
+++ trunk/server/src/main/org/jboss/ejb/plugins/SecurityInterceptor.java	2006-08-22 20:14:41 UTC (rev 56157)
@@ -32,6 +32,10 @@
 import org.jboss.security.RealmMapping;
 import org.jboss.security.RunAsIdentity;
 import org.jboss.security.SecurityConstants; 
+import org.jboss.security.audit.AuditContext;
+import org.jboss.security.audit.AuditEvent;
+import org.jboss.security.audit.AuditLevel;
+import org.jboss.security.audit.AuditManager;
 import org.jboss.security.authorization.AuthorizationContext;
 import org.jboss.security.authorization.EJBResource;
 import org.jboss.security.authorization.ResourceKeys; 
@@ -238,15 +242,18 @@
               authenticationObserver.authenticationFailed();
            // Check for the security association exception
            Exception ex = SecurityActions.getContextException();
+           errorAudit(principal,m.getName(),ex);
            if( ex != null )
               throw ex;
            // Else throw a generic SecurityException
            String msg = "Authentication exception, principal=" + principal;
            SecurityException e = new SecurityException(msg);
+           failureAudit(principal,m.getName());
            throw e;
         }
         else
         {
+           successAudit(principal,m.getName());
            SecurityActions.pushSubjectContext(principal, credential, subject);
            if (trace)
            {
@@ -283,6 +290,8 @@
      {
         int check = authorizationManager.authorize(ejbResource);
         isAuthorized = (check == AuthorizationContext.PERMIT);
+        authorizationAudit((isAuthorized ? AuditLevel.SUCCESS : AuditLevel.FAILURE)
+                            ,ejbResource, null);
      } 
      catch (Exception e)
      {
@@ -291,6 +300,7 @@
            log.trace("Error in authorization:",e);
         else
            log.error("Error in authorization:"+e.getLocalizedMessage());
+        authorizationAudit(AuditLevel.ERROR,ejbResource,e);
      } 
      String msg = "Denied: caller=" + caller;
      if(!isAuthorized)
@@ -320,4 +330,53 @@
      SecurityActions.popRunAsIdentity();
      return caller;
   }
+  
+  //******************************************************
+  //  Audit Methods
+  //******************************************************
+  private void audit(String level,
+        Map contextMap, Exception e)
+  { 
+     contextMap.put("Source", getClass().getName());
+     AuditContext ac = AuditManager.getAuditContext(securityManager.getSecurityDomain());
+     AuditEvent ae = new AuditEvent(level);
+     ae.setContextMap(contextMap);
+     ae.setUnderlyingException(e);
+     ac.audit(ae);   
+  }
+  
+  private void successAudit(Principal principal, String methodName)
+  { 
+     audit(AuditLevel.SUCCESS,getContextMap(principal, methodName),null);
+  } 
+  
+  private void failureAudit(Principal principal, String methodName)
+  { 
+     audit(AuditLevel.FAILURE,getContextMap(principal, methodName),null);
+  }
+  
+  private void errorAudit(Principal principal,
+        String methodName, Exception e)
+  { 
+     audit(AuditLevel.ERROR,getContextMap(principal, methodName),e);
+  }
+  
+  private void authorizationAudit(String level, EJBResource resource, Exception e)
+  {
+     //Authorization Exception stacktrace is huge. Scale it down
+     //as the original stack trace can be seen in server.log (if needed)
+     String exceptionMessage = e != null ? e.getLocalizedMessage() : "";  
+     Map cmap = new HashMap();
+     cmap.putAll(resource.getMap());
+     cmap.put("Exception:", exceptionMessage);
+     audit(level,cmap,null);
+  } 
+  
+  private Map getContextMap(Principal principal, String methodName)
+  {
+     Map cmap = new HashMap();
+     cmap.put("principal", principal);
+     cmap.put("method", methodName);
+     return cmap;
+  } 
 }