Including or Excluding Audit Event Fields In Logs

The safelist is designed to prevent logging of sensitive data for audit events by specifying which audit event fields appear in the logs. You can add or remove messages from the logs as follows:

To include audit event fields in logs that are not safelisted, configure the includeIf property of AuditService.
Important
Before you include non-safelisted audit event fields in the logs, consider the impact on security. Including some headers, query parameters, or cookies in the logs could cause credentials or tokens to be logged, and allow anyone with access to the logs to impersonate the holder of these credentials or tokens.
To exclude safelisted audit event fields from the logs, configure the excludeIf property of AuditService. For an example, see "Exclude Safelisted Audit Event Fields From Logs".

Exclude Safelisted Audit Event Fields From Logs

Set up recording for audit events, as described in "Recording Access Audit Events in JSON", and note the audit event fields in the log file access.audit.json.

Replace the route 30-json.json with the following route:

{
  "name": "30-json-excludeif",
  "baseURI": "http://app.example.com:8081",
  "condition": "${matches(request.uri.path, '^/home/json-audit-excludeif$')}",
  "heap": [
    {
      "name": "AuditService",
      "type": "AuditService",
      "config": {
        "config": {
          "filterPolicies": {
            "field": {
              "excludeIf": [
                "/access/http/request/headers/host",
                "/access/http/request/path",
                "/access/server",
                "/access/response"
              ]
            }
          }
        },
        "eventHandlers": [
          {
            "class": "org.forgerock.audit.handlers.json.JsonAuditEventHandler",
            "config": {
              "name": "json",
              "logDirectory": "/tmp/logs",
              "topics": [
                "access"
              ],
              "fileRetention": {
                "rotationRetentionCheckInterval": "1 minute"
              },
              "buffering": {
                "maxSize": 100000,
                "writeInterval": "100 ms"
              }
            }
          }
        ]
      }
    }
  ],
  "auditService": "AuditService",
  "handler": "ReverseProxyHandler"
}

Notice that the AuditService is configured with an excludeIf property to exclude audit event fields from the logs.

Go to http://openig.example.com:8080/home/json-audit-excludeif.

The home page of the sample application is displayed and the file /tmp/logs/access.audit.json is updated:

{
  "_id": "830...-41",
  "timestamp": "2019-...540Z",
  "eventName": "OPENIG-HTTP-ACCESS",
  "transactionId": "830...-40",
  "client": {
    "ip": "0:0:0:0:0:0:0:1",
    "port": 51666
  },
  "http": {
    "request": {
      "secure": false,
      "method": "GET",
      "headers": {
        "accept": ["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"],
        "user-agent": ["Mozilla/5.0 ... Firefox/66.0"]
      }
    }
  }
}

Compare the audit event fields in access.audit.json with those produced in "Recording Access Audit Events in JSON", and note that the audit event fields specified by the excludeIf property no longer appear in the logs.

Including or Excluding Audit Event Fields In Logs

Important