Spring Security OAuth2 event log - spring-security

Question

We have required to include OAuth2 in our application. For that we have chosen spring security as an approach. I have checked out the Spraklr2 & Tonr2 sample projects from spring security projects page. It is working fine.
Our new requirement is, as a outh2 provider we have to save each request log (request from resource owner).. We have to save client id, resource owner username, requested url (a resource on resource server), grant etc..
I have googled for some time, but didn't find any clue.
Can some one help me with any idea to achieve this..
Thanks in advance

Answer 1

When user is authenticated using Spring Oauth, it publishes an event to AuthenticationEventPublisher. You can create a component that implements AuthenticationEventPublisher as follows:
#Component
public class AuditEvent implements AuthenticationEventPublisher{
#Override
public void publishAuthenticationSuccess(Authentication authentication) {
if(authentication instanceof UsernamePasswordAuthenticationToken) {
log(authentication.getName(), "Authentication successful");
}
}
#Override
public void publishAuthenticationFailure(AuthenticationException exception, Authentication authentication) {
log(authentication.getName(),"Authentication Failure:");
}
}
And check if authentication is of type UsernamePasswordAuthenticationToken. This will provide you with login event which you can log as required.

Answer 2

if you mean that you want to log all requests to /oauth/authorize, and /oauth/token, you can do so by implementing your own endpoints, that will delegate the calls to AuthorizationEndpoint and TokenEndpoint respectively.
you will have to configure it in your XML files, of course...

Answer 3

In the case if you havent found the answer, below is the approach I used to Intercept requests..
<http path-type="regex"
create-session="never" entry-point-ref="oauthAuthenticationEntryPoint"
access-decision-manager-ref="accessDecisionManager"
use-expressions="true"
xmlns="http://www.springframework.org/schema/security">
<anonymous enabled="false" />
<custom-filter before="FILTER_SECURITY_INTERCEPTOR" ref="myFilterSecurityInterceptor" />
<intercept-url pattern="/soap/*" access="isAnonymous()" method="GET" />
<intercept-url pattern="/advisor/[0-9a-zA-Z_]/all/clients/[0-9]/[0-9]" access="isFullyAuthenticated()"/>
<custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
<access-denied-handler ref="oauthAccessDeniedHandler" />
<expression-handler ref="oauthWebExpressionHandler" />
</http>
<bean id="myFilterSecurityInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
<property name="authenticationManager" ref="authenticationManager"/>
<property name="accessDecisionManager" ref="affirmativeBasedAccessDecisionManager"/>
<property name="securityMetadataSource" ref="myCustomBean"/>
</bean>
<bean id="affirmativeBasedAccessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
<constructor-arg>
<list>
<bean id="roleVoter" class="org.springframework.security.access.vote.RoleVoter"/>
<bean id="authenticatedVoter" class="org.springframework.security.access.vote.AuthenticatedVoter"/>
</list>
</constructor-arg>
</bean>
<bean id="myCustomBean" class="MyCustomClass">
<constructor-arg>
<util:map />
</constructor-arg>
</bean>
<authentication-manager alias="authenticationManager" xmlns="http://www.springframework.org/schema/security">
<authentication-provider>
<jdbc-user-service data-source-ref="dataSource"
users-by-username-query=
"select username,password, enabled from oauth_users where username=?"
authorities-by-username-query=
"select username, role from oauth_user_roles where username =? " />
</authentication-provider>
</authentication-manager>
<bean id="oauthAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
<property name="realmName" value="realm" />
</bean>
<bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased" xmlns="http://www.springframework.org/schema/beans">
<constructor-arg>
<list>
<bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" />
<bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
<bean class="org.springframework.security.web.access.expression.WebExpressionVoter"/>
</list>
</constructor-arg>
</bean>
<bean id="oauthAccessDeniedHandler" class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />
<oauth:web-expression-handler id="oauthWebExpressionHandler" />
public class MyCustomClass extends DefaultFilterInvocationSecurityMetadataSource {
public APILibSecurityMetadataSource(
LinkedHashMap<RequestMatcher, Collection<ConfigAttribute>> requestMap) {
super(requestMap);
}
#Override
public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
System.out.println(" My code in MyCustomClass Interceptor");
}
}