Package com.unboundid.directory.sdk.broker.api

Class PolicyDecisionLogger

  • All Implemented Interfaces:
    Configurable, ExampleUsageProvider, Reconfigurable<PolicyDecisionLoggerConfig>, UnboundIDExtension
    @Extensible
@BrokerExtension
@ThreadSafety(level=INTERFACE_THREADSAFE)
public abstract class PolicyDecisionLogger
extends java.lang.Object
implements UnboundIDExtension, Reconfigurable<PolicyDecisionLoggerConfig>, ExampleUsageProvider
    This class defines an API that must be implemented by extensions which record information about PingAuthorize policy enforcement point (PEP) and policy decision point (PDP) activity

    Each policy decision logger may be configured to indicate whether to include the PDP response or exclude log messages based on their Policy Message Type. This is handled automatically by the server, so individual policy decision logger implementations do not need to attempt to perform that filtering on their own. However, they may perform additional processing if desired to further narrow the set of messages that should be logged.

    Configuring Policy Decision Loggers

    To configure a policy decision created using this API, use a command like: 
          dsconfig create-log-publisher \
           --publisher-name "{logger-name}" \
           --type third-party-policy-decision \
           --set enabled:true \
           --set "extension-class:{class-name}" \
           --set "extension-argument:{name=value}"
    where "{logger-name}" is the name to use for the policy decision logger instance, "{class-name}" is the fully-qualified name of the Java class that extends com.unboundid.directory.sdk.common.api .PolicyDecisionLogger, and "{name=value}" represents name-value pairs for any arguments to provide to the logger. If multiple arguments should be provided to the logger, then the "--set extension-argument:{name=value}" option should be provided multiple times.

    See ExamplePolicyDecisionLogger for a basic implementation.

    Tips:

    • Ensure the custom logger handles both DECISION and ADVICE policy message types.
    • Review the method-level documentation before implementing the log method. This documentation contains important information about the data being passed to the log method, including the contexts where such data is present.

    • Constructor Detail

      • PolicyDecisionLogger

        public PolicyDecisionLogger()
        Creates a new instance of this policy decision logger. All policy decision logger implementations must include a default constructor, but any initialization should generally be done in the initializePolicyDecisionLogger method.

    • Method Detail

      • defineConfigArguments

        public void defineConfigArguments​(ArgumentParser parser)
                           throws ArgumentException
        Updates the provided argument parser to define any configuration arguments which may be used by this extension. The argument parser may also be updated to define relationships between arguments (e.g., to specify required, exclusive, or dependent argument sets).
        Specified by:
        defineConfigArguments in interface Configurable
        Parameters:
        parser - The argument parser to be updated with the configuration arguments which may be used by this extension.
        Throws:
        ArgumentException - If a problem is encountered while updating the provided argument parser.

      • initializePolicyDecisionLogger

        public void initializePolicyDecisionLogger​(ServerContext serverContext,
                                           PolicyDecisionLoggerConfig config,
                                           ArgumentParser parser)
                                    throws LDAPException
        Initializes this policy decision logger.
        Parameters:
        serverContext - A handle to the server context for the server in which this extension is running.
        config - The general configuration for this policy decision logger.
        parser - The argument parser which has been initialized from the configuration for this policy decision logger.
        Throws:
        LDAPException - If a problem occurs while initializing this policy decision logger.

      • finalizePolicyDecisionLogger

        public void finalizePolicyDecisionLogger()
        Performs any cleanup which may be necessary when this policy decision logger is to be taken out of service.

      • log

        public abstract void log​(PolicyMessageType messageType,
                         java.util.Map<java.lang.String,​java.lang.String> logContext,
                         java.lang.String message)
        Logs a message.
        Parameters:
        messageType - The PolicyMessageType indicates the stage being logged in the decision processing lifecycle. The provided message type can be either PolicyMessageType.ADVICE or PolicyMessageType.DECISION.

        logContext - A set of key/value pairs summarizing and providing context for the policy decision or advice.

        Shared Keys: These keys are included in the logContext for both DECISION and ADVICE message types:

        Shared Keys
        requestID The unique identifier for the request.
        correlationID The correlation identifier for tracking requests.
        product The product name generating the log (e.g. Ping Identity PingAuthorize Server).
        instanceName The name of the server instance.
        clusterName The cluster name the instance belongs to.
        startupID A compact identifier that was assigned to the server instance at startup.
        threadID The identifier for the thread handling the request.
        from The source IP address and port of the request.
        method The HTTP method used in the request.
        url The request URL. Note that the logged value might differ slightly from the client-requested URL in minor ways.
        clientId The client ID. The logged value depends on the Access Token Validator handling the request.
        tokenOwner The value depends on the Token Resource Lookup Method performed by a handling Access Token Validator, and might not be present if token owner lookup is skipped.
        action The policy request action (e.g., "inbound-GET").
        service The service name provided in the decision request. This value will vary depending on whether the client request is a SCIM2, Gateway/Sideband, or a direct request to the policy decision engine (like a JSON PDP API request).
        resourcePath The path to the resource involved in the request. This value will vary depending on whether the client request is a SCIM2, Gateway/Sideband, or a direct request to the policy decision engine (like a JSON PDP API request).
        deploymentPackageId The unique identifier for the deployment package used during policy evaluation.
        decisionId The unique identifier for the decision.
        authorized Indicates if the request was authorized (true or false).
        decisionStatusCode The policy decision status code. Commonly "OKAY", but values such as "MISSING_ATTRIBUTE" in case of an error.
        decision The result of the decision (e.g., PERMIT, DENY).

        DECISION Only Keys: These keys are included in the logContext only for DECISION message types:

        DECISION Only Keys
        snapshotId The ID of the policy snapshot.
        decisionNodeId The ID of the deployment package's root decision node.
        adviceIds A comma-separated list of advice identifiers included in the decision response.
        adviceNames A comma-separated list of advice names included in the decision response. These are the names that policy writers used when constructing the policies.
        domain The decision request domain, if provided.
        identityProvider The identity provider included on the decision request. For client requests triggering Access Token Validation (e.g. Gateway, Sideband, etc.), this will be the name of the used Access Token Validator.

        ADVICE Only Keys: These keys are included in the logContext only for ADVICE message types:

        ADVICE Only Keys
        adviceImplId The advice implementation ID, corresponding to an advice ID in the configuration (e.g., "denied-reason").
        adviceImplName The advice implementation name, corresponding to an advice name in the configuration (e.g., "Denied Reason Advice").
        obligatory Indicates if the advice is obligatory (true or false).
        resourceModified Indicates whether the advice processing resulted in a modification to the HTTP request (for inbound advice processing) or the HTTP response (for outbound advice processing).

        message - The full response returned by the PDP in JSON format, which is logged if the DECISION policy message type is passed. If the include-pdp-response property is disabled or the message type does not record a decision response, the PDP response is null.

        The PDP message object is always null when the ADVICE policy message type is provided.

      • isConfigurationAcceptable

        public boolean isConfigurationAcceptable​(PolicyDecisionLoggerConfig config,
                                         ArgumentParser parser,
                                         java.util.List<java.lang.String> unacceptableReasons)
        Indicates whether the configuration represented by the provided argument parser is acceptable for use by this extension. The parser will have been used to parse any configuration available for this extension, and any automatic validation will have been performed. This method may be used to perform any more complex validation which cannot be performed automatically by the argument parser.
        Specified by:
        isConfigurationAcceptable in interface Reconfigurable<PolicyDecisionLoggerConfig>
        Parameters:
        config - The general configuration for this extension.
        parser - The argument parser that has been used to parse the proposed configuration for this extension.
        unacceptableReasons - A list to which messages may be added to provide additional information about why the provided configuration is not acceptable.
        Returns:
        true if the configuration in the provided argument parser appears to be acceptable, or false if not.

      • applyConfiguration

        public ResultCode applyConfiguration​(PolicyDecisionLoggerConfig config,
                                     ArgumentParser parser,
                                     java.util.List<java.lang.String> adminActionsRequired,
                                     java.util.List<java.lang.String> messages)
        Attempts to apply the configuration from the provided argument parser to this extension.
        Specified by:
        applyConfiguration in interface Reconfigurable<PolicyDecisionLoggerConfig>
        Parameters:
        config - The general configuration for this extension.
        parser - The argument parser that has been used to parse the new configuration for this extension.
        adminActionsRequired - A list to which messages may be added to provide additional information about any additional administrative actions that may be required to apply some of the configuration changes.
        messages - A list to which messages may be added to provide additional information about the processing performed by this method.
        Returns:
        A result code providing information about the result of applying the configuration change. A result of SUCCESS should be used to indicate that all processing completed successfully. Any other result will indicate that a problem occurred during processing.

      • getExtensionDescription

        public abstract java.lang.String[] getExtensionDescription()
        Retrieves a human-readable description for this extension. Each element of the array that is returned will be considered a separate paragraph in generated documentation.
        Specified by:
        getExtensionDescription in interface UnboundIDExtension
        Returns:
        A human-readable description for this extension, or null or an empty array if no description should be available.

      • getExamplesArgumentSets

        public java.util.Map<java.util.List<java.lang.String>,​java.lang.String> getExamplesArgumentSets()
        Retrieves a map containing examples of configurations that may be used for this extension. The map key should be a list of sample arguments, and the corresponding value should be a description of the behavior that will be exhibited by the extension when used with that configuration.
        Specified by:
        getExamplesArgumentSets in interface ExampleUsageProvider
        Returns:
        A map containing examples of configurations that may be used for this extension. It may be null or empty if there should not be any example argument sets.