Package org.elasticsearch.xpack.security.audit

Class AuditTrailService

java.lang.Object

org.elasticsearch.common.component.AbstractComponent

org.elasticsearch.xpack.security.audit.AuditTrailService

All Implemented Interfaces:

AuditTrail

public class AuditTrailService
extends AbstractComponent
implements AuditTrail

Field Summary

Fields inherited from class org.elasticsearch.common.component.AbstractComponent

logger

Fields inherited from interface org.elasticsearch.xpack.security.audit.AuditTrail

X_FORWARDED_FOR_HEADER

Constructor Summary

Constructors

Constructor	Description
AuditTrailService(java.util.List<AuditTrail> auditTrails, XPackLicenseState licenseState)

Method Summary

Modifier and Type	Method	Description
void	accessDenied(java.lang.String requestId, Authentication authentication, java.lang.String action, TransportMessage message, AuthorizationEngine.AuthorizationInfo authorizationInfo)
void	accessGranted(java.lang.String requestId, Authentication authentication, java.lang.String action, TransportMessage msg, AuthorizationEngine.AuthorizationInfo authorizationInfo)
void	anonymousAccessDenied(java.lang.String requestId, java.lang.String action, TransportMessage message)
void	anonymousAccessDenied(java.lang.String requestId, RestRequest request)
void	authenticationFailed(java.lang.String requestId, java.lang.String action, TransportMessage message)
void	authenticationFailed(java.lang.String requestId, java.lang.String realm, AuthenticationToken token, java.lang.String action, TransportMessage message)
void	authenticationFailed(java.lang.String requestId, java.lang.String realm, AuthenticationToken token, RestRequest request)
void	authenticationFailed(java.lang.String requestId, RestRequest request)
void	authenticationFailed(java.lang.String requestId, AuthenticationToken token, java.lang.String action, TransportMessage message)
void	authenticationFailed(java.lang.String requestId, AuthenticationToken token, RestRequest request)
void	authenticationSuccess(java.lang.String requestId, java.lang.String realm, User user, java.lang.String action, TransportMessage message)
void	authenticationSuccess(java.lang.String requestId, java.lang.String realm, User user, RestRequest request)
void	connectionDenied(java.net.InetAddress inetAddress, java.lang.String profile, SecurityIpFilterRule rule)
void	connectionGranted(java.net.InetAddress inetAddress, java.lang.String profile, SecurityIpFilterRule rule)	The AuditTrail.connectionGranted(InetAddress, String, SecurityIpFilterRule) and AuditTrail.connectionDenied(InetAddress, String, SecurityIpFilterRule) methods do not have a requestId because they related to a potentially long-lived TCP connection, not a single request.
void	explicitIndexAccessEvent(java.lang.String requestId, AuditLevel eventType, Authentication authentication, java.lang.String action, java.lang.String indices, java.lang.String requestName, TransportAddress remoteAddress, AuthorizationEngine.AuthorizationInfo authorizationInfo)	This is a "workaround" method to log index "access_granted" and "access_denied" events for actions not tied to a TransportMessage, or when the connection is not 1:1, i.e.
java.util.List<AuditTrail>	getAuditTrails()	Returns the audit trail implementations that this service delegates to.
java.lang.String	name()
void	runAsDenied(java.lang.String requestId, Authentication authentication, java.lang.String action, TransportMessage message, AuthorizationEngine.AuthorizationInfo authorizationInfo)
void	runAsDenied(java.lang.String requestId, Authentication authentication, RestRequest request, AuthorizationEngine.AuthorizationInfo authorizationInfo)
void	runAsGranted(java.lang.String requestId, Authentication authentication, java.lang.String action, TransportMessage message, AuthorizationEngine.AuthorizationInfo authorizationInfo)
void	tamperedRequest(java.lang.String requestId, java.lang.String action, TransportMessage message)
void	tamperedRequest(java.lang.String requestId, RestRequest request)
void	tamperedRequest(java.lang.String requestId, User user, java.lang.String action, TransportMessage request)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

AuditTrailService

public AuditTrailService(java.util.List<AuditTrail> auditTrails,
                         XPackLicenseState licenseState)

Method Detail

name

public java.lang.String name()

Specified by:

name in interface AuditTrail

getAuditTrails

public java.util.List<AuditTrail> getAuditTrails()

Returns the audit trail implementations that this service delegates to.

authenticationSuccess

public void authenticationSuccess(java.lang.String requestId,
                                  java.lang.String realm,
                                  User user,
                                  RestRequest request)

Specified by:

authenticationSuccess in interface AuditTrail

authenticationSuccess

public void authenticationSuccess(java.lang.String requestId,
                                  java.lang.String realm,
                                  User user,
                                  java.lang.String action,
                                  TransportMessage message)

Specified by:

authenticationSuccess in interface AuditTrail

anonymousAccessDenied

public void anonymousAccessDenied(java.lang.String requestId,
                                  java.lang.String action,
                                  TransportMessage message)

Specified by:

anonymousAccessDenied in interface AuditTrail

anonymousAccessDenied

public void anonymousAccessDenied(java.lang.String requestId,
                                  RestRequest request)

Specified by:

anonymousAccessDenied in interface AuditTrail

authenticationFailed

public void authenticationFailed(java.lang.String requestId,
                                 RestRequest request)

Specified by:

authenticationFailed in interface AuditTrail

authenticationFailed

public void authenticationFailed(java.lang.String requestId,
                                 java.lang.String action,
                                 TransportMessage message)

Specified by:

authenticationFailed in interface AuditTrail

authenticationFailed

public void authenticationFailed(java.lang.String requestId,
                                 AuthenticationToken token,
                                 java.lang.String action,
                                 TransportMessage message)

Specified by:

authenticationFailed in interface AuditTrail

authenticationFailed

public void authenticationFailed(java.lang.String requestId,
                                 java.lang.String realm,
                                 AuthenticationToken token,
                                 java.lang.String action,
                                 TransportMessage message)

Specified by:

authenticationFailed in interface AuditTrail

authenticationFailed

public void authenticationFailed(java.lang.String requestId,
                                 AuthenticationToken token,
                                 RestRequest request)

Specified by:

authenticationFailed in interface AuditTrail

authenticationFailed

public void authenticationFailed(java.lang.String requestId,
                                 java.lang.String realm,
                                 AuthenticationToken token,
                                 RestRequest request)

Specified by:

authenticationFailed in interface AuditTrail

accessGranted

public void accessGranted(java.lang.String requestId,
                          Authentication authentication,
                          java.lang.String action,
                          TransportMessage msg,
                          AuthorizationEngine.AuthorizationInfo authorizationInfo)

Specified by:

accessGranted in interface AuditTrail

accessDenied

public void accessDenied(java.lang.String requestId,
                         Authentication authentication,
                         java.lang.String action,
                         TransportMessage message,
                         AuthorizationEngine.AuthorizationInfo authorizationInfo)

Specified by:

accessDenied in interface AuditTrail

tamperedRequest

public void tamperedRequest(java.lang.String requestId,
                            RestRequest request)

Specified by:

tamperedRequest in interface AuditTrail

tamperedRequest

public void tamperedRequest(java.lang.String requestId,
                            java.lang.String action,
                            TransportMessage message)

Specified by:

tamperedRequest in interface AuditTrail

tamperedRequest

public void tamperedRequest(java.lang.String requestId,
                            User user,
                            java.lang.String action,
                            TransportMessage request)

Specified by:

tamperedRequest in interface AuditTrail

connectionGranted

public void connectionGranted(java.net.InetAddress inetAddress,
                              java.lang.String profile,
                              SecurityIpFilterRule rule)

Description copied from interface: AuditTrail

The AuditTrail.connectionGranted(InetAddress, String, SecurityIpFilterRule) and AuditTrail.connectionDenied(InetAddress, String, SecurityIpFilterRule) methods do not have a requestId because they related to a potentially long-lived TCP connection, not a single request. For both Transport and Rest connections, a single connection granted/denied event is generated even if that connection is used for multiple Elasticsearch actions (potentially as different users)

Specified by:

connectionGranted in interface AuditTrail

connectionDenied

public void connectionDenied(java.net.InetAddress inetAddress,
                             java.lang.String profile,
                             SecurityIpFilterRule rule)

Specified by:

connectionDenied in interface AuditTrail

runAsGranted

public void runAsGranted(java.lang.String requestId,
                         Authentication authentication,
                         java.lang.String action,
                         TransportMessage message,
                         AuthorizationEngine.AuthorizationInfo authorizationInfo)

Specified by:

runAsGranted in interface AuditTrail

runAsDenied

public void runAsDenied(java.lang.String requestId,
                        Authentication authentication,
                        java.lang.String action,
                        TransportMessage message,
                        AuthorizationEngine.AuthorizationInfo authorizationInfo)

Specified by:

runAsDenied in interface AuditTrail

runAsDenied

public void runAsDenied(java.lang.String requestId,
                        Authentication authentication,
                        RestRequest request,
                        AuthorizationEngine.AuthorizationInfo authorizationInfo)

Specified by:

runAsDenied in interface AuditTrail

explicitIndexAccessEvent

public void explicitIndexAccessEvent(java.lang.String requestId,
                                     AuditLevel eventType,
                                     Authentication authentication,
                                     java.lang.String action,
                                     java.lang.String indices,
                                     java.lang.String requestName,
                                     TransportAddress remoteAddress,
                                     AuthorizationEngine.AuthorizationInfo authorizationInfo)

Description copied from interface: AuditTrail

This is a "workaround" method to log index "access_granted" and "access_denied" events for actions not tied to a TransportMessage, or when the connection is not 1:1, i.e. several audit events for an action associated with the same message. It is currently only used to audit the resolved index (alias) name for each BulkItemRequest comprised by a BulkShardRequest. We should strive to not use this and TODO refactor it out!

Specified by:

explicitIndexAccessEvent in interface AuditTrail