0 Replies Latest reply on Nov 7, 2011 1:04 AM by Roberto Beeman

    JBoss 7.0.2Final Audit Logging issue

    Roberto Beeman Newbie

      Hi,

           I am trying to enable the audit logging for one of my web application. The Audit logging is working fine but i cna se following issues with it:

       

      issue-1).  The audit.log  does not provide the actual auditing informations like  Which page user is trying to access like the application uri (means the page which user is accessing). Like earlier we had a JAVA_OPTS in JBoss AS6 as "-Dorg.jboss.security.web.audit=headers,cookies,parameters"  It means the actual data which we mean by auditing is not at all there.  As auditing does not only mean checking whether user has logged in ot logged out ...rather auditing means knowing what a logged in user is doing/what all pages he is accessing and what all header/cookies informations he has.

       

      issue-2). If the user successfully logs in to the application then i get the TRACE logging inside the "audit.log" which is OK. but if the user enters a wrong credentials then Unwantedly i am getting the following exception in the JBossAS7 console

       

      [code]

      11:10:24,276 ERROR [org.jboss.security.authentication.JBossCachedAuthenticationManager] (http-localhost-127.0.0.1-8080-1) Login failure: javax.security.auth.login.FailedLoginException: Password Incorrect/Password Required

                at org.jboss.security.auth.spi.UsernamePasswordLoginModule.login(UsernamePasswordLoginModule.java:252) [picketbox-4.0.1.jar:4.0.1]

                at org.jboss.security.auth.spi.UsersRolesLoginModule.login(UsersRolesLoginModule.java:154) [picketbox-4.0.1.jar:4.0.1]

                at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) [:1.6.0_21]

                at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) [:1.6.0_21]

                at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) [:1.6.0_21]

                at java.lang.reflect.Method.invoke(Method.java:597) [:1.6.0_21]

                at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769) [:1.6.0_21]

                at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186) [:1.6.0_21]

                at javax.security.auth.login.LoginContext$4.run(LoginContext.java:683) [:1.6.0_21]

                at java.security.AccessController.doPrivileged(Native Method) [:1.6.0_21]

                at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680) [:1.6.0_21]

                at javax.security.auth.login.LoginContext.login(LoginContext.java:579) [:1.6.0_21]

      [/code]

       

      The above is an "ERROR" which is un-wanted it should either move to the DEBUG or TRACE category but it should not be in the ERROR category. Because it will fillup my log in realtime.

       

      issue-3). Irrrespective of user is what users.properties or roles.properties file  we have configred in the <security-domain> Tag of "standalong.xml/standalone-preview.xml"   the audit.log always displays the following Message :

       

      [code]

      11:02:44,955 TRACE [org.jboss.security.auth.spi.UsersRolesLoginModule] (http-localhost-127.0.0.1-8080-1) Loaded properties, users=[TestUser]

      11:02:44,955 TRACE [org.jboss.security.auth.spi.UsersRolesLoginModule] (http-localhost-127.0.0.1-8080-1) Failed to open default properties as URL: java.net.MalformedURLException: no protocol: defaultRoles.properties

                at java.net.URL.<init>(URL.java:567) [:1.6.0_21]

                at java.net.URL.<init>(URL.java:464) [:1.6.0_21]

                at java.net.URL.<init>(URL.java:413) [:1.6.0_21]

                at org.jboss.security.auth.spi.Util.loadProperties(Util.java:199) [picketbox-4.0.1.jar:4.0.1]

                at org.jboss.security.auth.spi.UsersRolesLoginModule.loadRoles(UsersRolesLoginModule.java:214) [picketbox-4.0.1.jar:4.0.1]

                at org.jboss.security.auth.spi.UsersRolesLoginModule.createRoles(UsersRolesLoginModule.java:228) [picketbox-4.0.1.jar:4.0.1]

                at org.jboss.security.auth.spi.UsersRolesLoginModule.initialize(UsersRolesLoginModule.java:130) [picketbox-4.0.1.jar:4.0.1]

                at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) [:1.6.0_21]

                at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) [:1.6.0_21]

                at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) [:1.6.0_21]

                at java.lang.reflect.Method.invoke(Method.java:597) [:1.6.0_21]

                at javax.security.auth.login.LoginContext.invoke(LoginContext.java:756) [:1.6.0_21]

                at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186) [:1.6.0_21]

                at javax.security.auth.login.LoginContext$4.run(LoginContext.java:683) [:1.6.0_21]

                at java.security.AccessController.doPrivileged(Native Method) [:1.6.0_21]

      [/code]

       

      Means it always expects for "defaultRoles.properties" file which makes my audit.log ugly.