-
Notifications
You must be signed in to change notification settings - Fork 76
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat (jans-cedarling): Create Decision Log optimized for Centralized …
…Log Storage (#10338) * feat(jans-cedarling): add log policy description on authorize request Signed-off-by: Oleh Bohzok <[email protected]> * feat(jans-cedarling): add logging cedar-policy `entities` as json for forensic analysis Signed-off-by: Oleh Bohzok <[email protected]> * docs(jans-cedarling): add example of log Signed-off-by: Oleh Bohzok <[email protected]> * chore(jans-cedarling): fix clippy issues Signed-off-by: Oleh Bohzok <[email protected]> * docs(jans-cedarling): update python types documentation Signed-off-by: Oleh Bohzok <[email protected]> * chore(jans-cedarling):remove commented code Signed-off-by: Oleh Bohzok <[email protected]> * docs(jans-cedarling): update log message information to be more clear Signed-off-by: Oleh Bohzok <[email protected]> * docs(jans-cedarling): add heading for log sample for better readability Signed-off-by: Oleh Bohzok <[email protected]> * feat(jans-cedarling): rename log `log_kind` to `log_type` Signed-off-by: Oleh Bohzok <[email protected]> * chore(jans-cedarling): rename LogEntry.id field to request_id Signed-off-by: Oleh Bohzok <[email protected]> * chore(jans-cedarling): update logger interface Signed-off-by: Oleh Bohzok <[email protected]> * chore(jans-cedarling): added DecisionLogEntry Signed-off-by: Oleh Bohzok <[email protected]> * feat(jans-cedarling): add loading bootstrap properties CEDARLING_DECISION_LOG_USER_CLAIMS and CEDARLING_DECISION_LOG_WORKLOAD_CLAIMS Signed-off-by: Oleh Bohzok <[email protected]> * feat(jans-cedarling): add log tokens claims Signed-off-by: Oleh Bohzok <[email protected]> * test(jans-cedarling): fix test cases to compile Signed-off-by: Oleh Bohzok <[email protected]> * feat(jans-cedarling): add bootstrap config CEDARLING_DECISION_LOG_DEFAULT_JWT_ID Signed-off-by: Oleh Bohzok <[email protected]> * docs(jans-cedarling): update python documentation Signed-off-by: Oleh Bohzok <[email protected]> * chore(jans-cedarling): update markdown doc via check plugin Signed-off-by: Oleh Bohzok <[email protected]> * docs(jans-cedarling): add new bootstrap properties to documentation Signed-off-by: Oleh Bohzok <[email protected]> * chore(jans-cedarling): cut long log message in documentation Signed-off-by: Oleh Bohzok <[email protected]> * docs(jans-cedarling): add to documentation example of decision log. Signed-off-by: Oleh Bohzok <[email protected]> * chore(jans-cedarling): fix clippy issues Signed-off-by: Oleh Bohzok <[email protected]> * docs(jans-cedarling): fix python documentation Signed-off-by: Oleh Bohzok <[email protected]> * docs(jans-cedarling): fix python documentation Signed-off-by: Oleh Bohzok <[email protected]> --------- Signed-off-by: Oleh Bohzok <[email protected]>
- Loading branch information
1 parent
efb7ab6
commit 019e5ae
Showing
33 changed files
with
970 additions
and
298 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -49,17 +49,196 @@ logs and can stream to a database or S3 bucket. The Cedarling decision logs prov | |
| evidence of usage of the domain's externalized policies. The logs are also useful for forensic | ||
| analysis to show everything the attacker attempted, both allowed and denied. | ||
|
|
||
| ## Startup Message | ||
| ## Sample logs | ||
|
|
||
| The JSON in this document is formatted for readability but is not prettified in the actual implementation. | ||
|
|
||
| ### Startup Message | ||
|
|
||
| ```json | ||
| { | ||
| "id": "01937359-8968-766e-bc4a-82df4aa1f4bf", | ||
| "time": 1732807068, | ||
| "id": "01937015-462d-7727-b789-ed95f7faf7a4", | ||
| "time": 1732752262, | ||
| "log_kind": "System", | ||
| "pdp_id": "75f0dc93-0a90-4076-95fa-dc16d3f00375", | ||
| "msg": "configuration parsed successfully" | ||
| } | ||
| { | ||
| "id": "01937015-462f-7cb5-86bb-d06c56dc5ab3", | ||
| "time": 1732752262, | ||
| "log_kind": "System", | ||
| "pdp_id": "b862f21f-bcb1-4618-995d-ba7041e9bd16", | ||
| "pdp_id": "75f0dc93-0a90-4076-95fa-dc16d3f00375", | ||
| "msg": "Cedarling Authz initialized successfully", | ||
| "application_id": "TestApp", | ||
| "cedar_lang_version": "4.1.0", | ||
| "cedar_sdk_version": "4.2.2" | ||
| } | ||
| ``` | ||
|
|
||
| ### Decision Log | ||
|
|
||
| Example of decision log. | ||
|
|
||
| ```json | ||
| { | ||
| "request_id": "019394db-f52b-7b06-88b8-a288670a32c2", | ||
| "timestamp": "2024-12-05T05:27:43.403Z", | ||
| "log_type": "Decision", | ||
| "pdp_id": "9e189c4b-96ae-4818-8e7f-75a42186af15", | ||
| "policystore_id": "a1bf93115de86de760ee0bea1d529b521489e5a11747", | ||
| "policystore_version": "undefined", | ||
| "principal": "User & Workload", | ||
| "User": { | ||
| "username": "[email protected]" | ||
| }, | ||
| "Workload": { | ||
| "org_id": "some_long_id" | ||
| }, | ||
| "lock_client_id": null, | ||
| "action": "Jans::Action::\"Update\"", | ||
| "resource": "Jans::Issue::\"random_id\"", | ||
| "decision": "ALLOW", | ||
| "tokens": { | ||
| "id_token": { | ||
| "jti": "id_tkn_jti" | ||
| }, | ||
| "Userinfo": { | ||
| "jti": "usrinfo_tkn_jti" | ||
| }, | ||
| "access": { | ||
| "jti": "access_tkn_jti" | ||
| } | ||
| }, | ||
| "decision_time_ms": 3 | ||
| } | ||
| ``` | ||
|
|
||
| #### Field Definitions | ||
|
|
||
| * `request_id`: unique identifier for the decision request | ||
| * `timestamp`: Derived if possible from the system or context--may be empty in cases where WASM can't access the system clock, and the time wasn't sent in the context. | ||
| * `pdp_id`: unique identifier for the Cedarling | ||
| * `policystore_id`: What policystore this Cedarling instance is using | ||
| * `policystore_version`: What version of the policystore the Cedarling is using | ||
| * `principal`: `User` | `Workload` | ||
| * `User`: A list of claims, specified by the `CEDARLING_DECISION_LOG_USER_CLAIMS` property, that must be present in the Cedar User entity | ||
| * `Workload`: A list of claims, specified by the `CEDARLING_DECISION_LOG_WORKLOAD_CLAIMS` property, that must be present in the Cedar Workload entity | ||
| * `lock_client_id`: If this Cedarling has registered with a Lock Server, what is the client_id it received | ||
| * `action`: From the request | ||
| * `resource`: From the Request | ||
| * `decision`: `ALLOW` or `DENY` | ||
| * `tokens`: Dictionary with the token type and claims which should be included in the log | ||
| * `decision_time_ms`: how long the decision took | ||
|
|
||
| ### Debug Log Sample | ||
|
|
||
| The result of the authorization is quite extensive because we log all `cedar-policy` entity information for forensic analysis. We cannot truncate the data, as it may contain critical information. | ||
|
|
||
| ```json | ||
| { | ||
| "id": "01937015-4649-7aad-8df8-4976e4bd8565", | ||
| "time": 1732752262, | ||
| "log_kind": "Decision", | ||
| "pdp_id": "75f0dc93-0a90-4076-95fa-dc16d3f00375", | ||
| "msg": "Result of authorize.", | ||
| "application_id": "TestApp", | ||
| "action": "Jans::Action::\"Read\"", | ||
| "resource": "Jans::Application::\"some_id\"", | ||
| "context": { | ||
| "user_agent": "Linux", | ||
| "operating_system": "Linux", | ||
| "network_type": "Local", | ||
| "network": "127.0.0.1", | ||
| "geolocation": [ | ||
| "America" | ||
| ], | ||
| "fraud_indicators": [ | ||
| "Allowed" | ||
| ], | ||
| "device_health": [ | ||
| "Healthy" | ||
| ], | ||
| "current_time": 1732752262 | ||
| }, | ||
| "entities": [ | ||
| { | ||
| "uid": { | ||
| "type": "Jans::User", | ||
| "id": "qzxn1Scrb9lWtGxVedMCky-Ql_ILspZaQA6fyuYktw0" | ||
| }, | ||
| "attrs": { | ||
| "sub": "qzxn1Scrb9lWtGxVedMCky-Ql_ILspZaQA6fyuYktw0", | ||
| "role": [ | ||
| "CasaAdmin" | ||
| ], | ||
| "email": { | ||
| "domain": "jans.test", | ||
| "uid": "admin" | ||
| } | ||
| }, | ||
| "parents": [ | ||
| { | ||
| "type": "Jans::Role", | ||
| "id": "CasaAdmin" | ||
| } | ||
| ] | ||
| }, | ||
| { | ||
| "uid": { | ||
| "type": "Jans::id_token", | ||
| "id": "ijLZO1ooRyWrgIn7cIdNyA" | ||
| }, | ||
| "attrs": { | ||
| "sub": "qzxn1Scrb9lWtGxVedMCky-Ql_ILspZaQA6fyuYktw0", | ||
| "acr": "simple_password_auth", | ||
| "exp": 1731956630, | ||
| "jti": "ijLZO1ooRyWrgIn7cIdNyA", | ||
| "amr": [], | ||
| "aud": "d7f71bea-c38d-4caf-a1ba-e43c74a11a62", | ||
| "iss": { | ||
| "__entity": { | ||
| "type": "Jans::TrustedIssuer", | ||
| "id": "https://account.gluu.org" | ||
| } | ||
| }, | ||
| "iat": 1731953030 | ||
| }, | ||
| "parents": [] | ||
| }, | ||
|
|
||
| ... | ||
|
|
||
| { | ||
| "uid": { | ||
| "type": "Jans::Action", | ||
| "id": "Tag" | ||
| }, | ||
| "attrs": {}, | ||
| "parents": [] | ||
| } | ||
| ], | ||
| "person_principal": "Jans::User::\"qzxn1Scrb9lWtGxVedMCky-Ql_ILspZaQA6fyuYktw0\"", | ||
| "person_diagnostics": { | ||
| "reason": [ | ||
| { | ||
| "id": "840da5d85403f35ea76519ed1a18a33989f855bf1cf8", | ||
| "description": "simple policy example for principal user" | ||
| } | ||
| ], | ||
| "errors": [] | ||
| }, | ||
| "person_decision": "ALLOW", | ||
| "workload_principal": "Jans::Workload::\"d7f71bea-c38d-4caf-a1ba-e43c74a11a62\"", | ||
| "workload_diagnostics": { | ||
| "reason": [ | ||
| { | ||
| "id": "444da5d85403f35ea76519ed1a18a33989f855bf1cf8", | ||
| "description": "simple policy example for principal workload" | ||
| } | ||
| ], | ||
| "errors": [] | ||
| }, | ||
| "workload_decision": "ALLOW", | ||
| "authorized": true | ||
| } | ||
| ``` | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.