Package org.apache.directory.fortress.core

Interface AuditMgr

All Superinterfaces:

Manageable

All Known Implementing Classes:

AuditMgrImpl, AuditMgrRestImpl

public interface AuditMgr
extends Manageable

This interface prescribes methods used to search OpenLDAP's slapd access log. The access log events are persisted in BDB and available for inquiry via common LDAP protocols. Audit entries stored on behalf of Fortress operations correspond to runtime authentication Bind, authorization AuthZ and modification Mod events as they occur automatically on the server when audit is enabled.

Audit Interrogator

Provides an OpenLDAP access log retrieval mechanism that enables security event monitoring.

1. Authentication events:
2. • Session enablement events
   • Authorization events
   • Entity mods and deletes

All events include Fortress context, see FortEntity.

The following APIs generate events subsequently stored in this access log:

• AccessMgr
• AdminMgr
• AdminMgr
• DelAdminMgr
• ConfigMgr
• PwPolicyMgr

The following reports are supported using search input: UserAudit

• User Authentications: List<Bind> searchBinds(org.apache.directory.fortress.core.model.UserAudit)
• Invalid User AuthN: List<Bind> searchInvalidUsers(org.apache.directory.fortress.core.model.UserAudit)
• User Authorizations 1: List<AuthZ> getUserAuthZs(org.apache.directory.fortress.core.model.UserAudit)
• User Authorizations 2: List<AuthZ> searchAuthZs(org.apache.directory.fortress.core.model.UserAudit)
• User Session Activations: List<Mod> searchUserSessions(org.apache.directory.fortress.core.model.UserAudit)
• Entity Modifications: List<Mod> searchAdminMods(org.apache.directory.fortress.core.model.UserAudit)

This interface's implementer will NOT be thread safe if parent instance variables (Manageable.setContextId(String) or Manageable.setAdmin(org.apache.directory.fortress.core.model.Session)) are set.

Author:

Apache Directory Project

Method Summary

Modifier and Type	Method	Description
List<AuthZ>	getUserAuthZs(UserAudit uAudit)	This method returns a list of authorization events for a particular user UserAudit.userId and given timestamp field UserAudit.beginDate. Method also can discriminate between all events or failed only by setting UserAudit.failedOnly.
List<Mod>	searchAdminMods(UserAudit uAudit)	This method returns a list of admin operations events for a particular entity UserAudit.dn, object UserAudit.objName and timestamp UserAudit.beginDate.
List<AuthZ>	searchAuthZs(UserAudit uAudit)	This method returns a list of authorization events for a particular user UserAudit.userId, object UserAudit.objName, and given timestamp field UserAudit.beginDate. Method also can discriminate between all events or failed only by setting flag UserAudit.failedOnly..
List<Bind>	searchBinds(UserAudit uAudit)	This method returns a list of authentication audit events for a particular user UserAudit.userId, and given timestamp field UserAudit.beginDate.
List<AuthZ>	searchInvalidUsers(UserAudit uAudit)	This method returns a list of failed authentication attempts on behalf of an invalid identity UserAudit.userId, and given timestamp UserAudit.beginDate.
List<Mod>	searchUserSessions(UserAudit uAudit)	This method returns a list of sessions created for a given user UserAudit.userId, and timestamp UserAudit.beginDate.

Methods inherited from interface org.apache.directory.fortress.core.Manageable

setAdmin, setContextId

Method Detail

getUserAuthZs

List<AuthZ> getUserAuthZs(UserAudit uAudit)
                   throws SecurityException

This method returns a list of authorization events for a particular user UserAudit.userId and given timestamp field UserAudit.beginDate.
Method also can discriminate between all events or failed only by setting UserAudit.failedOnly.

optional parameters

• UserAudit.userId - contains the target userId
• UserAudit.beginDate - contains the date in which to begin search
• UserAudit.failedOnly - if set to 'true', return only failed authorization events

Parameters:

uAudit - This entity is instantiated and populated before invocation.

Returns:

a List of objects of type AuthZ. Each AuthZ object contains one authorization event.

Throws:

SecurityException - if a runtime system error occurs.

searchAuthZs

List<AuthZ> searchAuthZs(UserAudit uAudit)
                  throws SecurityException

This method returns a list of authorization events for a particular user UserAudit.userId, object UserAudit.objName, and given timestamp field UserAudit.beginDate.
Method also can discriminate between all events or failed only by setting flag UserAudit.failedOnly..

required parameters

• UserAudit.userId - contains the target userId
• UserAudit.objName - contains the object (authorization resource) name

optional parameters

• UserAudit.beginDate - contains the date in which to begin search
• UserAudit.failedOnly - if set to 'true', return only failed authorization events

Parameters:

uAudit - This entity is instantiated and populated before invocation.

Returns:

a List of objects of type AuthZ. Each AuthZ object contains one authorization event.

Throws:

SecurityException - if a runtime system error occurs.

searchBinds

List<Bind> searchBinds(UserAudit uAudit)
                throws SecurityException

This method returns a list of authentication audit events for a particular user UserAudit.userId, and given timestamp field UserAudit.beginDate.

optional parameters

• UserAudit.userId - contains the target userId
• UserAudit.beginDate - contains the date in which to begin search
• UserAudit.failedOnly - if set to 'true', return only failed authorization events

Parameters:

uAudit - This entity is instantiated and populated before invocation.

Returns:

a List of objects of type Bind. Each Bind object contains one bind event.

Throws:

SecurityException - if a runtime system error occurs.

searchUserSessions

List<Mod> searchUserSessions(UserAudit uAudit)
                      throws SecurityException

This method returns a list of sessions created for a given user UserAudit.userId, and timestamp UserAudit.beginDate.

required parameters

• UserAudit.userId - contains the target userId

optional parameters

• UserAudit.beginDate - contains the date in which to begin search

Parameters:

uAudit - This entity is instantiated and populated before invocation.

Returns:

a List of objects of type Mod. Each Mod object in list corresponds to one update or delete event on directory.

Throws:

SecurityException - if a runtime system error occurs.

searchAdminMods

List<Mod> searchAdminMods(UserAudit uAudit)
                   throws SecurityException

This method returns a list of admin operations events for a particular entity UserAudit.dn, object UserAudit.objName and timestamp UserAudit.beginDate. If the internal userId UserAudit.internalUserId is set it will limit search by that field.

optional parameters

• UserAudit.dn - contains the LDAP distinguished name for the updated object. For example if caller wants to find out what changes were made to John Doe's user object this would be 'uid=jdoe,ou=People,dc=example,dc=com'
• UserAudit.objName - contains the object (authorization resource) name corresponding to the event. For example if caller wants to return events where User object was modified, this would be 'updateUser'
• UserAudit.internalUserId - maps to the internalUserId of user who changed the record in LDAP. This maps to User.internalId.
• UserAudit.beginDate - contains the date in which to begin search
• UserAudit.endDate - contains the date in which to end search

Parameters:

uAudit - This entity is instantiated and populated before invocation.

Returns:

a List of objects of type Mod. Each Mod object in list corresponds to one update or delete event on directory.

Throws:

SecurityException - if a runtime system error occurs.

searchInvalidUsers

List<AuthZ> searchInvalidUsers(UserAudit uAudit)
                        throws SecurityException

This method returns a list of failed authentication attempts on behalf of an invalid identity UserAudit.userId, and given timestamp UserAudit.beginDate. If the UserAudit.failedOnly is true it will return only authentication attempts made with invalid userId. This event represents either User incorrectly entering userId during signon or possible fraudulent logon attempt by hostile agent.

This event is generated when Fortress looks up User record prior to LDAP bind operation.

optional parameters

• UserAudit.userId - contains the target userId
• UserAudit.beginDate - contains the date in which to begin search
• UserAudit.failedOnly - if set to 'true', return only failed authorization events

Parameters:

uAudit - This entity is instantiated and populated before invocation.

Returns:

a List of objects of type AuthZ. Each AuthZ object contains one failed authentication event.

Throws:

SecurityException - if a runtime system error occurs.