mirror of
https://github.com/openziti/ziti.git
synced 2026-10-27 14:07:11 +00:00
Andrew Martinez
8415a7dbf6
* The controller and the router wrote the complete service session token, an OIDC service session JWT or a legacy session token, into structured log fields during edge control operations. Several of the sites logged at Error or Info, so the values reached logs at default verbosity during ordinary operation. * Adds LoggingFields to the session and api session types in common, controller/model and router/state, so a logging site asks for the session fields or the api session fields instead of picking values by hand. Ids, type, identity, service and the token's validity window go in; the token does not. Empty values are dropped, so the sets merge over each other. * AddLoggingFields in router/state now delegates to LoggingFields. Its output moves from a nested field to flat prefixed keys. * The edge control handlers log the session field set on the shared returnError and logResult paths, on circuit setup and on terminator update. The terminator removal paths log the terminator id, since they never load a session. * Adds unit tests over returnError and logResult that fail if a session token reaches a log entry, covering the loaded-session, failed-to-load and JWT-claims cases.
100 lines
3.3 KiB
Go
100 lines
3.3 KiB
Go
/*
|
|
Copyright NetFoundry Inc.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
https://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package common
|
|
|
|
import (
|
|
"time"
|
|
|
|
"github.com/golang-jwt/jwt/v5"
|
|
"github.com/sirupsen/logrus"
|
|
)
|
|
|
|
// LoggingFields returns the fields that describe this service access token to a log or an
|
|
// audit trail: who it was minted for, what it grants access to, and when it is valid. The
|
|
// raw token is a credential and never appears among them. Pass the result to
|
|
// logrus.Entry.WithFields.
|
|
//
|
|
// A claim the token did not carry is left out rather than logged empty, so the result can be
|
|
// merged over a field set built from stored state without blanking it.
|
|
func (c *ServiceAccessClaims) LoggingFields() logrus.Fields {
|
|
fields := logrus.Fields{}
|
|
|
|
if c == nil {
|
|
return fields
|
|
}
|
|
|
|
addLogString(fields, "sessionId", c.ID)
|
|
addLogString(fields, "sessionType", c.Type)
|
|
addLogString(fields, "identityId", c.IdentityId)
|
|
addLogString(fields, "serviceId", c.Subject)
|
|
addLogString(fields, "apiSessionId", c.ApiSessionId)
|
|
addLogJwtTime(fields, "sessionIssuedAt", c.IssuedAt)
|
|
addLogJwtTime(fields, "sessionNotBefore", c.NotBefore)
|
|
addLogJwtTime(fields, "sessionExpiresAt", c.ExpiresAt)
|
|
fields["sessionIsLegacy"] = c.IsLegacy
|
|
|
|
return fields
|
|
}
|
|
|
|
// LoggingFields returns the fields that describe this access token to a log or an audit
|
|
// trail. The raw token is a credential and never appears among them. Pass the result to
|
|
// logrus.Entry.WithFields.
|
|
//
|
|
// A claim the token did not carry is left out rather than logged empty, so the result can be
|
|
// merged over a field set built from stored state without blanking it.
|
|
func (r *AccessClaims) LoggingFields() logrus.Fields {
|
|
fields := logrus.Fields{}
|
|
|
|
if r == nil {
|
|
return fields
|
|
}
|
|
|
|
addLogString(fields, "apiSessionId", r.ApiSessionId)
|
|
addLogString(fields, "apiSessionTokenId", r.JWTID)
|
|
addLogString(fields, "apiSessionType", r.CustomClaims.Type)
|
|
addLogString(fields, "apiSessionRemoteAddress", r.RemoteAddress)
|
|
addLogString(fields, "identityId", r.Subject)
|
|
addLogTime(fields, "apiSessionIssuedAt", r.IssuedAt.AsTime())
|
|
addLogTime(fields, "apiSessionNotBefore", r.NotBefore.AsTime())
|
|
addLogTime(fields, "apiSessionExpiresAt", r.Expiration.AsTime())
|
|
|
|
return fields
|
|
}
|
|
|
|
// addLogString records a value, skipping it when it is empty.
|
|
func addLogString(fields logrus.Fields, name string, value string) {
|
|
if value != "" {
|
|
fields[name] = value
|
|
}
|
|
}
|
|
|
|
// addLogJwtTime records a JWT time claim in RFC3339 form, skipping a claim the token did not
|
|
// carry.
|
|
func addLogJwtTime(fields logrus.Fields, name string, value *jwt.NumericDate) {
|
|
if value != nil {
|
|
addLogTime(fields, name, value.Time)
|
|
}
|
|
}
|
|
|
|
// addLogTime records a timestamp in RFC3339 form, skipping the zero value, which means no
|
|
// time was carried rather than a time at the epoch.
|
|
func addLogTime(fields logrus.Fields, name string, value time.Time) {
|
|
if !value.IsZero() {
|
|
fields[name] = value.UTC().Format(time.RFC3339)
|
|
}
|
|
}
|