Feature/add principal event logging (#30)

Added logging to endpoints to log what principal is attempting to invoke them

src/main/java/com/nike/cerberus/dao/SafeDepositBoxDao.java

@@ -85,4 +85,8 @@ public String getSafeDepositBoxIdByName(String name) {
         return safeDepositBoxMapper.getSafeDepositBoxIdByName(name);
     }
 
+    public String getSafeDepositBoxNameById(String id) {
+        return safeDepositBoxMapper.getSafeDepositBoxNameById(id);
+    }
+
 }

src/main/java/com/nike/cerberus/endpoints/AdminStandardEndpoint.java

@@ -24,6 +24,8 @@
 import com.nike.riposte.server.http.ResponseInfo;
 import com.nike.riposte.server.http.StandardEndpoint;
 import io.netty.channel.ChannelHandlerContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import javax.ws.rs.core.SecurityContext;
 import java.util.Optional;
@@ -35,13 +37,24 @@
  */
 public abstract class AdminStandardEndpoint<I, O> extends StandardEndpoint<I, O> {
 
+    private final Logger log = LoggerFactory.getLogger(getClass());
+
     public final CompletableFuture<ResponseInfo<O>> execute(final RequestInfo<I> request,
                                                             final Executor longRunningTaskExecutor,
                                                             final ChannelHandlerContext ctx) {
+
         final Optional<SecurityContext> securityContext =
                 CmsRequestSecurityValidator.getSecurityContextForRequest(request);
 
+        String principal = securityContext.isPresent() ?
+                securityContext.get().getUserPrincipal() instanceof VaultAuthPrincipal ?
+                        securityContext.get().getUserPrincipal().getName() :
+                        "( Principal is not a Vault auth principal. )" : "( Principal name is empty. )";
+
+        log.info("Admin Endpoint Event: the principal {} is attempting to access admin endpoint: {}", principal, this.getClass().getName());
         if (!securityContext.isPresent() || !securityContext.get().isUserInRole(VaultAuthPrincipal.ROLE_ADMIN)) {
+            log.error("Admin Endpoint Event: the principal {} is attempted to access {}, an admin endpoint but was not an admin", principal,
+                    this.getClass().getName());
             throw new ApiException(DefaultApiError.ACCESS_DENIED);
         }
 

src/main/java/com/nike/cerberus/endpoints/admin/PutSDBMetadata.java

@@ -27,6 +27,8 @@
 import io.netty.channel.ChannelHandlerContext;
 import io.netty.handler.codec.http.HttpMethod;
 import io.netty.handler.codec.http.HttpResponseStatus;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import javax.ws.rs.core.SecurityContext;
 import java.util.concurrent.CompletableFuture;
@@ -37,6 +39,8 @@
  */
 public class PutSDBMetadata extends AdminStandardEndpoint<SDBMetadata, Void> {
 
+    private final Logger log = LoggerFactory.getLogger(getClass());
+
     private final MetadataService metadataService;
 
     @Inject
@@ -52,7 +56,12 @@ public CompletableFuture<ResponseInfo<Void>> doExecute(RequestInfo<SDBMetadata>
 
         return CompletableFuture.supplyAsync(() -> {
             VaultAuthPrincipal vaultAuthPrincipal = (VaultAuthPrincipal) securityContext.getUserPrincipal();
-            metadataService.restoreMetadata(request.getContent(), vaultAuthPrincipal.getName());
+
+            String principal = vaultAuthPrincipal.getName();
+
+            log.info("Metadata Restore Event: the principal {} is attempting to restore sdb name: '{}'", principal, request.getContent().getName());
+
+            metadataService.restoreMetadata(request.getContent(), principal);
 
             return ResponseInfo.<Void>newBuilder()
                     .withHttpStatusCode(HttpResponseStatus.NO_CONTENT.code())

src/main/java/com/nike/cerberus/endpoints/authentication/AuthenticateIamRoleV1.java

@@ -19,12 +19,15 @@
 import com.nike.cerberus.domain.IamRoleAuthResponse;
 import com.nike.cerberus.domain.IamRoleCredentialsV1;
 import com.nike.cerberus.service.AuthenticationService;
+import com.nike.cerberus.util.AwsIamRoleArnParser;
 import com.nike.riposte.server.http.RequestInfo;
 import com.nike.riposte.server.http.ResponseInfo;
 import com.nike.riposte.server.http.StandardEndpoint;
 import com.nike.riposte.util.Matcher;
 import io.netty.channel.ChannelHandlerContext;
 import io.netty.handler.codec.http.HttpMethod;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import javax.inject.Inject;
 import java.util.concurrent.CompletableFuture;
@@ -37,6 +40,8 @@
 @Deprecated
 public class AuthenticateIamRoleV1 extends StandardEndpoint<IamRoleCredentialsV1, IamRoleAuthResponse> {
 
+    private final Logger log = LoggerFactory.getLogger(getClass());
+
     private final AuthenticationService authenticationService;
 
     @Inject
@@ -48,9 +53,15 @@ public AuthenticateIamRoleV1(final AuthenticationService authenticationService)
     public CompletableFuture<ResponseInfo<IamRoleAuthResponse>> execute(final RequestInfo<IamRoleCredentialsV1> request,
                                                                         final Executor longRunningTaskExecutor,
                                                                         final ChannelHandlerContext ctx) {
-        return CompletableFuture.supplyAsync(() ->
-                ResponseInfo.newBuilder(authenticationService.authenticate(request.getContent())).build(),
-                longRunningTaskExecutor);
+        return CompletableFuture.supplyAsync(() -> {
+            IamRoleCredentialsV1 credentials = request.getContent();
+            log.info("IAM Auth Event: the IAM principal {} in attempting to authenticate in region {}",
+                    String.format(AwsIamRoleArnParser.AWS_IAM_ROLE_ARN_TEMPLATE,
+                            credentials.getAccountId(), credentials.getRoleName()), credentials.getRegion());
+
+            return ResponseInfo.newBuilder(authenticationService.authenticate(request.getContent())).build();
+        }, longRunningTaskExecutor);
+
     }
 
     @Override

src/main/java/com/nike/cerberus/endpoints/authentication/AuthenticateIamRoleV2.java

@@ -18,14 +18,18 @@
 package com.nike.cerberus.endpoints.authentication;
 
 import com.nike.cerberus.domain.IamRoleAuthResponse;
+import com.nike.cerberus.domain.IamRoleCredentialsV1;
 import com.nike.cerberus.domain.IamRoleCredentialsV2;
 import com.nike.cerberus.service.AuthenticationService;
+import com.nike.cerberus.util.AwsIamRoleArnParser;
 import com.nike.riposte.server.http.RequestInfo;
 import com.nike.riposte.server.http.ResponseInfo;
 import com.nike.riposte.server.http.StandardEndpoint;
 import com.nike.riposte.util.Matcher;
 import io.netty.channel.ChannelHandlerContext;
 import io.netty.handler.codec.http.HttpMethod;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import javax.inject.Inject;
 import java.util.concurrent.CompletableFuture;
@@ -37,6 +41,8 @@
  */
 public class AuthenticateIamRoleV2 extends StandardEndpoint<IamRoleCredentialsV2, IamRoleAuthResponse> {
 
+    private final Logger log = LoggerFactory.getLogger(getClass());
+
     private final AuthenticationService authenticationService;
 
     @Inject
@@ -48,9 +54,13 @@ public AuthenticateIamRoleV2(final AuthenticationService authenticationService)
     public CompletableFuture<ResponseInfo<IamRoleAuthResponse>> execute(final RequestInfo<IamRoleCredentialsV2> request,
                                                                         final Executor longRunningTaskExecutor,
                                                                         final ChannelHandlerContext ctx) {
-        return CompletableFuture.supplyAsync(() ->
-                ResponseInfo.newBuilder(authenticationService.authenticate(request.getContent())).build(),
-                longRunningTaskExecutor);
+        return CompletableFuture.supplyAsync(() -> {
+            IamRoleCredentialsV2 credentials = request.getContent();
+            log.info("IAM Auth Event: the IAM principal {} in attempting to authenticate in region {}",
+                    credentials.getRoleArn(), credentials.getRegion());
+
+            return ResponseInfo.newBuilder(authenticationService.authenticate(request.getContent())).build();
+        }, longRunningTaskExecutor);
     }
 
     @Override

src/main/java/com/nike/cerberus/endpoints/authentication/AuthenticateUser.java

@@ -29,6 +29,8 @@
 import io.netty.handler.codec.http.HttpMethod;
 import org.apache.commons.codec.binary.Base64;
 import org.apache.commons.lang3.ArrayUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import javax.inject.Inject;
 import javax.ws.rs.core.HttpHeaders;
@@ -41,6 +43,8 @@
  */
 public class AuthenticateUser extends StandardEndpoint<Void, AuthResponse> {
 
+    private final Logger log = LoggerFactory.getLogger(getClass());
+
     private final AuthenticationService authenticationService;
 
     @Inject
@@ -56,6 +60,9 @@ public CompletableFuture<ResponseInfo<AuthResponse>> execute(final RequestInfo<V
                 () -> {
                     final UserCredentials credentials =
                             extractCredentials(request.getHeaders().get(HttpHeaders.AUTHORIZATION));
+
+                    log.info("User Auth Event: the principal: {} is attempting to authenticate", credentials.getUsername());
+
                     return ResponseInfo.newBuilder(authenticationService.authenticate(credentials)).build();
                 },
                 longRunningTaskExecutor

src/main/java/com/nike/cerberus/endpoints/authentication/RefreshUserToken.java

@@ -28,6 +28,8 @@
 import com.nike.riposte.util.Matcher;
 import io.netty.channel.ChannelHandlerContext;
 import io.netty.handler.codec.http.HttpMethod;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import javax.inject.Inject;
 import javax.ws.rs.core.SecurityContext;
@@ -40,6 +42,8 @@
  */
 public class RefreshUserToken extends StandardEndpoint<Void, AuthResponse> {
 
+    private final Logger log = LoggerFactory.getLogger(getClass());
+
     private final AuthenticationService authenticationService;
 
     @Inject
@@ -62,6 +66,10 @@ public ResponseInfo<AuthResponse> getRefreshedUserToken(final RequestInfo<Void>
                 CmsRequestSecurityValidator.getSecurityContextForRequest(request);
 
         if (securityContext.isPresent()) {
+            final VaultAuthPrincipal vaultAuthPrincipal =
+                    (VaultAuthPrincipal) securityContext.get().getUserPrincipal();
+            log.info("Refresh User Token Auth Event: the principal: {} is attempting to refresh its token", vaultAuthPrincipal.getName());
+
             return ResponseInfo.newBuilder(
                     authenticationService.refreshUserToken(
                             (VaultAuthPrincipal) securityContext.get().getUserPrincipal())).build();

src/main/java/com/nike/cerberus/endpoints/authentication/RevokeToken.java

@@ -28,6 +28,8 @@
 import io.netty.channel.ChannelHandlerContext;
 import io.netty.handler.codec.http.HttpMethod;
 import io.netty.handler.codec.http.HttpResponseStatus;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import javax.inject.Inject;
 import javax.ws.rs.core.SecurityContext;
@@ -40,6 +42,8 @@
  */
 public class RevokeToken extends StandardEndpoint<Void, Void> {
 
+    private final Logger log = LoggerFactory.getLogger(getClass());
+
     private final AuthenticationService authenticationService;
 
     @Inject
@@ -61,6 +65,9 @@ public ResponseInfo<Void> revokeToken(RequestInfo<Void> request) {
         if (securityContext.isPresent()) {
             final VaultAuthPrincipal vaultAuthPrincipal =
                     (VaultAuthPrincipal) securityContext.get().getUserPrincipal();
+
+            log.info("Delete Token Auth Event: the principal: {} is attempting to delete a token", vaultAuthPrincipal.getName());
+
             authenticationService.revoke(vaultAuthPrincipal.getClientToken().getId());
             return ResponseInfo.<Void>newBuilder().withHttpStatusCode(HttpResponseStatus.NO_CONTENT.code()).build();
         }

src/main/java/com/nike/cerberus/endpoints/sdb/CreateSafeDepositBox.java

@@ -31,6 +31,8 @@
 import io.netty.handler.codec.http.DefaultHttpHeaders;
 import io.netty.handler.codec.http.HttpMethod;
 import io.netty.handler.codec.http.HttpResponseStatus;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import javax.inject.Inject;
 import javax.ws.rs.core.SecurityContext;
@@ -46,6 +48,8 @@
  */
 public class CreateSafeDepositBox extends StandardEndpoint<SafeDepositBox, Map<String, String>> {
 
+    private final Logger log = LoggerFactory.getLogger(getClass());
+
     public static final String BASE_PATH = "/v1/safe-deposit-box";
 
     public static final String HEADER_X_REFRESH_TOKEN = "X-Refresh-Token";
@@ -71,6 +75,10 @@ private ResponseInfo<Map<String, String>> createSafeDepositBox(final RequestInfo
 
         if (securityContext.isPresent()) {
             final VaultAuthPrincipal vaultAuthPrincipal = (VaultAuthPrincipal) securityContext.get().getUserPrincipal();
+
+            log.info("Create SDB Event: the principal: {} is attempting to create sdb name: '{}'",
+                    vaultAuthPrincipal.getName(), request.getContent().getName());
+
             final String id =
                     safeDepositBoxService.createSafeDepositBox(request.getContent(), vaultAuthPrincipal.getName());
 

src/main/java/com/nike/cerberus/endpoints/sdb/DeleteSafeDepositBox.java

@@ -29,6 +29,8 @@
 import io.netty.handler.codec.http.DefaultHttpHeaders;
 import io.netty.handler.codec.http.HttpMethod;
 import io.netty.handler.codec.http.HttpResponseStatus;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import javax.inject.Inject;
 import javax.ws.rs.core.SecurityContext;
@@ -41,6 +43,8 @@
  */
 public class DeleteSafeDepositBox extends StandardEndpoint<Void, Void> {
 
+    private final Logger log = LoggerFactory.getLogger(getClass());
+
     public static final String HEADER_X_REFRESH_TOKEN = "X-Refresh-Token";
 
     private final SafeDepositBoxService safeDepositBoxService;
@@ -61,7 +65,15 @@ private ResponseInfo<Void> deleteSafeDepositBox(final RequestInfo<Void> request)
 
         if (securityContext.isPresent()) {
             final VaultAuthPrincipal vaultAuthPrincipal = (VaultAuthPrincipal) securityContext.get().getUserPrincipal();
-            safeDepositBoxService.deleteSafeDepositBox(vaultAuthPrincipal.getUserGroups(), request.getPathParam("id"));
+
+            String sdbId = request.getPathParam("id");
+            Optional<String> sdbNameOptional = safeDepositBoxService.getSafeDepositBoxNameById(sdbId);
+            String sdbName = sdbNameOptional.isPresent() ? sdbNameOptional.get() :
+                    String.format("(Failed to lookup name from id: %s)", sdbId);
+            log.info("Delete SDB Event: the principal: {} is attempting to delete sdb name: '{}' and id: '{}'",
+                    vaultAuthPrincipal.getName(), sdbName, sdbId);
+
+            safeDepositBoxService.deleteSafeDepositBox(vaultAuthPrincipal.getUserGroups(), sdbId);
             return ResponseInfo.<Void>newBuilder().withHttpStatusCode(HttpResponseStatus.OK.code())
                     .withHeaders(new DefaultHttpHeaders().set(HEADER_X_REFRESH_TOKEN, Boolean.TRUE.toString()))
                     .build();

src/main/java/com/nike/cerberus/endpoints/sdb/GetSafeDepositBox.java

@@ -29,6 +29,8 @@
 import com.nike.riposte.util.Matcher;
 import io.netty.channel.ChannelHandlerContext;
 import io.netty.handler.codec.http.HttpMethod;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import javax.inject.Inject;
 import javax.ws.rs.core.SecurityContext;
@@ -42,6 +44,8 @@
  */
 public class GetSafeDepositBox extends StandardEndpoint<Void, SafeDepositBox> {
 
+    private final Logger log = LoggerFactory.getLogger(getClass());
+
     private final SafeDepositBoxService safeDepositBoxService;
 
     @Inject
@@ -62,10 +66,18 @@ public ResponseInfo<SafeDepositBox> getSafeDepositBox(final RequestInfo<Void> re
 
         if (securityContext.isPresent()) {
             final VaultAuthPrincipal vaultAuthPrincipal = (VaultAuthPrincipal) securityContext.get().getUserPrincipal();
+
+            String sdbId = request.getPathParam("id");
+            Optional<String> sdbNameOptional = safeDepositBoxService.getSafeDepositBoxNameById(sdbId);
+            String sdbName = sdbNameOptional.isPresent() ? sdbNameOptional.get() :
+                    String.format("(Failed to lookup name from id: %s)", sdbId);
+            log.info("Read SDB Event: the principal: {} is attempting to read sdb name: '{}' and id: '{}'",
+                    vaultAuthPrincipal.getName(), sdbName, sdbId);
+
             final Optional<SafeDepositBox> safeDepositBox =
                     safeDepositBoxService.getAssociatedSafeDepositBox(
                             vaultAuthPrincipal.getUserGroups(),
-                            request.getPathParam("id"));
+                            sdbId);
 
             if (safeDepositBox.isPresent()) {
                 return ResponseInfo.newBuilder(safeDepositBox.get()).build();

src/main/java/com/nike/cerberus/endpoints/sdb/GetSafeDepositBoxes.java

@@ -28,6 +28,8 @@
 import com.nike.riposte.util.Matcher;
 import io.netty.channel.ChannelHandlerContext;
 import io.netty.handler.codec.http.HttpMethod;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import javax.inject.Inject;
 import javax.ws.rs.core.SecurityContext;
@@ -42,6 +44,8 @@
  */
 public class GetSafeDepositBoxes extends StandardEndpoint<Void, List<SafeDepositBoxSummary>> {
 
+    private final Logger log = LoggerFactory.getLogger(getClass());
+
     private final SafeDepositBoxService safeDepositBoxService;
 
     @Inject
@@ -63,6 +67,9 @@ public ResponseInfo<List<SafeDepositBoxSummary>> getSafeDepositBoxes(final Reque
         if (securityContext.isPresent()) {
             final VaultAuthPrincipal vaultAuthPrincipal = (VaultAuthPrincipal) securityContext.get().getUserPrincipal();
 
+            log.info("List SDB Event: the principal: {} is attempting to list the SDBs that it has access to",
+                    vaultAuthPrincipal.getName());
+
             return ResponseInfo.newBuilder(
                     safeDepositBoxService.getAssociatedSafeDepositBoxes(vaultAuthPrincipal.getUserGroups())).build();
         }