Uploaded image for project: 'OpenIDM'
  1. OpenIDM
  2. OPENIDM-9353

IDM does not audit the http response headers in the access audit log

    Details

    • Type: Bug
    • Status: Open
    • Priority: Major
    • Resolution: Unresolved
    • Affects Version/s: OpenIDM 6.0.0
    • Fix Version/s: None
    • Component/s: Module - Audit

      Description

      OpenIDM is not auditing the http response headers in the access audit log. This seems to have just been an oversight. The org.forgerock.openidm.audit.filter.AuditFilter class needs to be updated to populate the http response headers.

      This can be acomplished by adding the httpResponse() method call to the OpenIDMAccessAuditEventBuilder class like so:

              OpenIDMAccessAuditEventBuilder(Context context, Request request) {
                  super();
                  rolesFromCrestContext(context);
                  forHttpRequest(context, request);
                  httpResponse(getHeaders())
                  requestFromCrestRequest(request);
                  clientFromContext(context);
                  httpFromContext(context);
                  transactionIdFromContext(context);
                  eventName(ACCESS);
                  userId(getUserId(context));
              }
      

        Attachments

          Activity

            People

            • Assignee:
              jason Jason Lemay
              Reporter:
              jason Jason Lemay
            • Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

              • Created:
                Updated: