LoggingAuditService implements UaaAuditService { @Override public void log(AuditEvent auditEvent, String zoneId) { updateCounters(auditEvent); String logMessage = String.format("%s ('%s'): principal=%s, origin=[%s], identityZoneId=[%s]", auditEvent.getType().name(), auditEvent.getData(), auditEvent.getPrincipalId(), auditEvent.getOrigin(), auditEvent.getIdentityZoneId() ); if (auditEvent.getAuthenticationType() != null) { logMessage = String.format("%s, authenticationType=[%s]", logMessage, auditEvent.getAuthenticationType()); } log(logMessage); }  @ManagedMetric(metricType = MetricType.COUNTER, displayName = "User Not Found Count") int getUserNotFoundCount(); @ManagedMetric(metricType = MetricType.COUNTER, displayName = "User Successful Authentication Count") int getUserAuthenticationCount(); @ManagedMetric(metricType = MetricType.COUNTER, displayName = "User Authentication Failure Count") int getUserAuthenticationFailureCount(); @ManagedMetric(metricType = MetricType.COUNTER, displayName = "Client Successful Authentication Count") int getClientAuthenticationCount(); @ManagedMetric(metricType = MetricType.COUNTER, displayName = "Client Authentication Failure Count") int getClientAuthenticationFailureCount(); @ManagedMetric(metricType = MetricType.COUNTER, displayName = "Principal (non-user) Authentication Failure Count") int getPrincipalAuthenticationFailureCount(); @ManagedMetric(metricType = MetricType.COUNTER, displayName = "Principal (non-user) Not Found Count") int getPrincipalNotFoundCount(); @ManagedMetric(metricType = MetricType.COUNTER, displayName = "User Password Change Count (Since Startup)") int getUserPasswordChanges(); @ManagedMetric(metricType = MetricType.COUNTER, displayName = "User Password Change Failure Count (Since Startup)") int getUserPasswordFailures(); @Override List<AuditEvent> find(String principal, long after, String zoneId); @Override void log(AuditEvent auditEvent, String zoneId); void setLogger(Logger logger); Logger getLogger();  }
@Test void log_format_whenThereIsAnAuthType() { AuditEvent auditEvent = new AuditEvent(PasswordChangeFailure, "thePrincipalId", "theOrigin", "theData", 42L, "theZoneId", "theAuthType", "theDescription"); loggingAuditService.log(auditEvent, "not-used"); ArgumentCaptor<String> stringCaptor = ArgumentCaptor.forClass(String.class); verify(mockLogger).info(stringCaptor.capture()); String logMessage = stringCaptor.getValue(); assertThat(logMessage, is("PasswordChangeFailure ('theData'): principal=thePrincipalId, origin=[theOrigin], identityZoneId=[theZoneId], authenticationType=[theAuthType]")); }
@Test void log_format_whenAuthTypeIsNull() { AuditEvent auditEvent = new AuditEvent(PasswordChangeFailure, "thePrincipalId", "theOrigin", "theData", 42L, "theZoneId", null, "theDescription"); loggingAuditService.log(auditEvent, "not-used"); ArgumentCaptor<String> stringCaptor = ArgumentCaptor.forClass(String.class); verify(mockLogger).info(stringCaptor.capture()); String logMessage = stringCaptor.getValue(); assertThat(logMessage, is("PasswordChangeFailure ('theData'): principal=thePrincipalId, origin=[theOrigin], identityZoneId=[theZoneId]")); }
@Test void log_sanitizesMaliciousInput() { AuditEvent auditEvent = new AuditEvent(UserAuthenticationSuccess, "principalId", "origin", "data", 100L, "malicious-zone\r\n\t", null, null); loggingAuditService.log(auditEvent, "not-used"); ArgumentCaptor<String> stringCaptor = ArgumentCaptor.forClass(String.class); verify(mockLogger).info(stringCaptor.capture()); assertFalse(stringCaptor.getValue().contains("\r")); assertFalse(stringCaptor.getValue().contains("\n")); assertFalse(stringCaptor.getValue().contains("\t")); assertTrue(stringCaptor.getValue().contains(LogSanitizerUtil.SANITIZED_FLAG)); }
@Test void log_doesNotModifyNonMaliciousInput() { AuditEvent auditEvent = new AuditEvent(UserAuthenticationSuccess, "principalId", "origin", "data", 100L, "safe-zone", null, null); loggingAuditService.log(auditEvent, "not-used"); ArgumentCaptor<String> stringCaptor = ArgumentCaptor.forClass(String.class); verify(mockLogger).info(stringCaptor.capture()); assertFalse(stringCaptor.getValue().contains(LogSanitizerUtil.SANITIZED_FLAG)); }