View Javadoc
1   /**
2    * This file Copyright (c) 2003-2018 Magnolia International
3    * Ltd.  (http://www.magnolia-cms.com). All rights reserved.
4    *
5    *
6    * This file is dual-licensed under both the Magnolia
7    * Network Agreement and the GNU General Public License.
8    * You may elect to use one or the other of these licenses.
9    *
10   * This file is distributed in the hope that it will be
11   * useful, but AS-IS and WITHOUT ANY WARRANTY; without even the
12   * implied warranty of MERCHANTABILITY or FITNESS FOR A
13   * PARTICULAR PURPOSE, TITLE, or NONINFRINGEMENT.
14   * Redistribution, except as permitted by whichever of the GPL
15   * or MNA you select, is prohibited.
16   *
17   * 1. For the GPL license (GPL), you can redistribute and/or
18   * modify this file under the terms of the GNU General
19   * Public License, Version 3, as published by the Free Software
20   * Foundation.  You should have received a copy of the GNU
21   * General Public License, Version 3 along with this program;
22   * if not, write to the Free Software Foundation, Inc., 51
23   * Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
24   *
25   * 2. For the Magnolia Network Agreement (MNA), this file
26   * and the accompanying materials are made available under the
27   * terms of the MNA which accompanies this distribution, and
28   * is available at http://www.magnolia-cms.com/mna.html
29   *
30   * Any modifications to this file must keep this entire header
31   * intact.
32   *
33   */
34  package info.magnolia.audit;
35  
36  import info.magnolia.cms.security.UserManager;
37  import info.magnolia.cms.security.auth.login.FormLogin;
38  import info.magnolia.cms.security.auth.login.LoginResult;
39  import info.magnolia.context.Context;
40  import info.magnolia.context.MgnlContext;
41  import info.magnolia.context.SystemContext;
42  import info.magnolia.context.UserContext;
43  
44  import javax.jcr.nodetype.NodeType;
45  import javax.servlet.http.HttpServletRequest;
46  
47  /**
48   * Utilities class used to log 'auditory actions'.
49   */
50  public class AuditLoggingUtil {
51  
52      public static final String ACTION_CREATE = "create";
53      public static final String ACTION_MODIFY = "modify";
54      public static final String ACTION_DELETE = "delete";
55      public static final String ACTION_COPY = "copy";
56      public static final String ACTION_MOVE = "move";
57      public static final String ACTION_ACTIVATE = "activate";
58      public static final String ACTION_DEACTIVATE = "deactivate";
59      public static final String ACTION_LOGIN = "login";
60      public static final String ACTION_LOGOUT = "logout";
61      public static final String ACTION_SECURITY = "security";
62  
63      /**
64       * Log activate, deactivate incl. node type.
65       */
66      public static void log(String action, String workspaceName, NodeType nodeType, String nodePath) {
67          AuditLoggingUtil.log(action, new String[]{AuditLoggingUtil.getUser(), workspaceName, nodeType == null ? "" : nodeType.getName(), nodePath});
68      }
69  
70      /**
71       * Log publish, unpublish.
72       */
73      public static void log(String action, String userName, String workspaceName, NodeType nodeType, String nodePathTo) {
74          AuditLoggingUtil.log(action, new String[]{userName, workspaceName, nodeType == null ? "" : nodeType.getName(), nodePathTo});
75      }
76  
77      /**
78       * Log copy, move.
79       */
80      public static void log(String action, String workspaceName, String nodePathFrom, String nodePathTo) {
81          AuditLoggingUtil.log(action, new String[]{AuditLoggingUtil.getUser(), workspaceName, nodePathFrom, nodePathTo});
82      }
83  
84      /**
85       * Log create, modify, delete and move in session.
86       */
87      public static void log(String action, long timeStamp, String workspaceName, NodeType nodeType, String path, String pathTo) {
88          AuditLoggingUtil.log(action, new String[]{String.valueOf(timeStamp), AuditLoggingUtil.getUser(), workspaceName, nodeType == null ? "" : nodeType.getName(), path, pathTo == null ? "" : pathTo});
89      }
90  
91      /**
92       * Log copy to another workspace.
93       */
94      public static void log(String action, String workspaceFrom, String workspaceTo, String nodePathFrom, String nodePathTo) {
95          AuditLoggingUtil.log(action, new String[]{AuditLoggingUtil.getUser(), workspaceFrom, workspaceTo, nodePathFrom, nodePathTo});
96      }
97  
98      /**
99       * Log user logout.
100      */
101     public static void log(final UserContext userContext) {
102         AuditLoggingUtil.log(AuditLoggingUtil.ACTION_LOGOUT, null, (String) null, null);
103     }
104 
105     /**
106      * Log user login.
107      */
108     public static void log(final LoginResult loginResult, final HttpServletRequest request) {
109         int loginStatus = loginResult.getStatus();
110 
111         if (loginStatus == LoginResult.STATUS_SUCCEEDED_REDIRECT_REQUIRED || loginStatus == LoginResult.STATUS_SUCCEEDED || loginStatus == LoginResult.STATUS_FAILED) {
112             // need request as if the user is not logged yet, the id is not in the context
113             String userId = request.getParameter(FormLogin.PARAMETER_USER_ID);
114             if (UserManager.ANONYMOUS_USER.equals(userId)) {
115                 // do not log for anonymous
116                 return;
117             }
118 
119             String result;
120             if (loginStatus == LoginResult.STATUS_SUCCEEDED || loginStatus == LoginResult.STATUS_SUCCEEDED_REDIRECT_REQUIRED) {
121                 result = "Success";
122             } else {
123                 result = "Failure " + loginResult.getLoginException().getLocalizedMessage();
124             }
125 
126             AuditLoggingUtil.log(AuditLoggingUtil.ACTION_LOGIN, new String[]{userId, request.getRemoteAddr(), result});
127         }
128     }
129 
130     /**
131      * Log a security event.
132      */
133     public static void logSecurity(String ipAddress, String securityEventType, String securityEventdetails) {
134         AuditLoggingUtil.log(AuditLoggingUtil.ACTION_SECURITY, new String[]{getUser(), ipAddress, securityEventType, securityEventdetails});
135     }
136 
137     private static void log(String action, String[] data) {
138         AuditLoggingManager manager = AuditLoggingManager.getInstance();
139         if (manager != null) {
140             manager.log(action, data);
141         }
142     }
143 
144     private static String getUser() {
145         try {
146             Context ctx = null;
147             if (MgnlContext.isSystemInstance()) {
148                 // in system context try to obtain original non-system context and retrieve user from it
149                 ctx = ((SystemContext) MgnlContext.getInstance()).getOriginalContext();
150                 if (ctx == null) {
151                     // when original context is not set, revert to old behavior and log user as "SystemUser"
152                     return "SystemUser";
153                 }
154                 if (ctx.getUser() != null) {
155                     // log user and prepend "system" to the name to show in audit log that action was executed via system context w/o user really having privileges set to do such op on his own
156                     return "System [" + ctx.getUser().getName() + "]";
157                 }
158             } else if (MgnlContext.hasInstance()) {
159                 // when op is executed in normal context, just retrieve user and log user
160                 ctx = MgnlContext.getInstance();
161                 if (ctx.getUser() != null) {
162                     return ctx.getUser().getName();
163                 }
164             }
165         } catch (Exception e) {
166             // log system user, but using different name to signify (internally) that there was something out-of-ordinary happening when trying to generate audit log
167             return "system user";
168         }
169         // context is not set or it is set but without user which should never really occur except during initialization
170         return "user not set";
171     }
172 
173 }