Security Framework Logging
Each time the Arbortext PE Request Manager receives a request and evaluates it, it writes an entry to an audit log file describing the request itself, the decision reached `(allow to proceed, reject), and the reason for the decision. Following is an example from an audit log file:
09:27:20 [http-apr-8080-exec-2] INFO GateLogEntry.auditLog -
uri='/e3/servlet/e3' secured='false' host='127.0.0.1'
addr='127.0.0.1' protocol='HTTP/1.1' scheme='http' method='GET'
query='f=status' sc='admin-requests' authReq='true'
alreadyAuth='false' triedAuth='true' rcAuth='false'
remoteUser=null' allowed='false' why='du' status='401'
reason='Response set up to request authentication.'
09:27:25 [http-apr-8080-exec-3] INFO GateLogEntry.auditLog -
uri='/e3/servlet/e3' secured='false' host='127.0.0.1'
addr='127.0.0.1' protocol='HTTP/1.1' scheme='http'
method='GET' query='f=status' sc='admin-requests'
authReq='true' alreadyAuth= 'false' triedAuth='true'
rcAuth='true' remoteUser=ati' allowed='true' why='arm'
status='200' reason='user 'ati' has role 'pe-admin''
10:53:47 [http-apr-8080-exec-6] INFO GateLogEntry.auditLog -
uri='/e3/jsp/queuelist.jsp' secured='false' host='127.0.0.1'
addr='127.0.0.1' protocol='HTTP/1.1' scheme='http' method='GET'
query='null' sc='admin-requests' authReq='true'
alreadyAuth='false' triedAuth='true' rcAuth='false'
remoteUser=null' allowed='false' why='du' status='401'
reason='Response set up to request authentication.'
10:53:47 [http-apr-8080-exec-7] INFO GateLogEntry.auditLog -
uri='/e3/jsp/queuelist.jsp' secured='false' host='127.0.0.1'
addr='127.0.0.1' protocol='HTTP/1.1' scheme='http' method='GET'
query='null' sc='admin-requests' authReq='true'
alreadyAuth='false' triedAuth='true' rcAuth='true' remoteUser=ati'
allowed='true' why='arm' status='200'
reason='user 'ati' has role 'pe-admin''
10:53:52 [http-apr-8080-exec-5] INFO GateLogEntry.auditLog -
uri='/e3/servlet/e3' secured='false' host='127.0.0.1'
addr='127.0.0.1' protocol='HTTP/1.1' scheme='http' method='GET'
query='f=app&file=$aptpath/e3/e3/e3demo.3f'
sc='unrestricted-requests' authReq='false' alreadyAuth='false'
triedAuth='false' rcAuth='false' remoteUser='null' allowed='true'
why='aru' status='200'
reason='No authentication required for this request.'
Each entry starts with the time of the request, the thread ID, the message level, and the issuing module. Each entry then reports the following items:
• uri — URI of the request as received by Arbortext Publishing Engine
• host — Name of the Arbortext PE server
• addr — IP address of the Arbortext PE server
• protocol — Request protocol
• scheme — Scheme of the URL (http or https)
• query — The request query string
• sc — ID of the security constraint that matched the request
• authReq — "true" if authentication was required. Otherwise, "false".
• alreadyAuth — "true" if the request was already authenticated
• triedAuth — "true" if the Arbortext PE Request Manager tried to authenticate the request
• rcAuth — "true" or "false" as returned from the authentication attempt
• remoteUser — User ID of an authenticated request
• allowed — "true" if the security constraint allowed the request to proceed. Otherwise, "false".
• why — Value to provide to PTC Technical Support when filing a case
• status — HTTP result code returned if access was denied
• reason — Description of why access was or was not allowed
Use the following approaches to ensure requests are being properly accepted and rejected.
• Examine the audit log file.
• Open e3config.xml and set the debug flag to “true”. Send requests to Arbortext Publishing Engine and examine the servlet log.