mirror of
https://github.com/openziti/ziti.git
synced 2026-10-27 14:07:11 +00:00
Andrew Martinez
8415a7dbf6
* The controller and the router wrote the complete service session token, an OIDC service session JWT or a legacy session token, into structured log fields during edge control operations. Several of the sites logged at Error or Info, so the values reached logs at default verbosity during ordinary operation. * Adds LoggingFields to the session and api session types in common, controller/model and router/state, so a logging site asks for the session fields or the api session fields instead of picking values by hand. Ids, type, identity, service and the token's validity window go in; the token does not. Empty values are dropped, so the sets merge over each other. * AddLoggingFields in router/state now delegates to LoggingFields. Its output moves from a nested field to flat prefixed keys. * The edge control handlers log the session field set on the shared returnError and logResult paths, on circuit setup and on terminator update. The terminator removal paths log the terminator id, since they never load a session. * Adds unit tests over returnError and logResult that fail if a session token reaches a log entry, covering the loaded-session, failed-to-load and JWT-claims cases.
84 lines
2.7 KiB
Go
84 lines
2.7 KiB
Go
/*
|
|
Copyright NetFoundry Inc.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
https://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package model
|
|
|
|
import (
|
|
"time"
|
|
|
|
"github.com/sirupsen/logrus"
|
|
)
|
|
|
|
// LoggingFields returns the fields that identify this service session to a log or an audit
|
|
// trail: which identity holds it, which service it grants, and which api session it hangs
|
|
// off. The session token is a credential and never appears among them. Pass the result to
|
|
// logrus.Entry.WithFields.
|
|
//
|
|
// A field the session does not carry is left out rather than logged empty.
|
|
func (entity *Session) LoggingFields() logrus.Fields {
|
|
fields := logrus.Fields{}
|
|
|
|
if entity == nil {
|
|
return fields
|
|
}
|
|
|
|
addLogString(fields, "sessionId", entity.Id)
|
|
addLogString(fields, "sessionType", entity.Type)
|
|
addLogString(fields, "identityId", entity.IdentityId)
|
|
addLogString(fields, "serviceId", entity.ServiceId)
|
|
addLogString(fields, "apiSessionId", entity.ApiSessionId)
|
|
addLogTime(fields, "sessionCreatedAt", entity.CreatedAt)
|
|
|
|
return fields
|
|
}
|
|
|
|
// LoggingFields returns the fields that identify this api session to a log or an audit
|
|
// trail. The api session token is a credential and never appears among them. Pass the
|
|
// result to logrus.Entry.WithFields.
|
|
//
|
|
// A field the api session does not carry is left out rather than logged empty.
|
|
func (entity *ApiSession) LoggingFields() logrus.Fields {
|
|
fields := logrus.Fields{}
|
|
|
|
if entity == nil {
|
|
return fields
|
|
}
|
|
|
|
addLogString(fields, "apiSessionId", entity.Id)
|
|
addLogString(fields, "identityId", entity.IdentityId)
|
|
addLogString(fields, "apiSessionIpAddress", entity.IPAddress)
|
|
addLogString(fields, "apiSessionAuthenticatorId", entity.AuthenticatorId)
|
|
addLogTime(fields, "apiSessionExpiresAt", entity.ExpiresAt)
|
|
addLogTime(fields, "apiSessionLastActivityAt", entity.LastActivityAt)
|
|
|
|
return fields
|
|
}
|
|
|
|
// addLogString records a value, skipping it when it is empty.
|
|
func addLogString(fields logrus.Fields, name string, value string) {
|
|
if value != "" {
|
|
fields[name] = value
|
|
}
|
|
}
|
|
|
|
// addLogTime records a timestamp in RFC3339 form, skipping the zero value, which means the
|
|
// entity carried no time rather than a time at the epoch.
|
|
func addLogTime(fields logrus.Fields, name string, value time.Time) {
|
|
if !value.IsZero() {
|
|
fields[name] = value.UTC().Format(time.RFC3339)
|
|
}
|
|
}
|