com.sap.cloud.sdk.cloudplatform.auditlog

Class ScpNeoAuditLog

java.lang.Object

com.sap.cloud.sdk.cloudplatform.auditlog.ScpNeoAuditLog

All Implemented Interfaces:

AuditLog

public class ScpNeoAuditLog
extends Object
implements AuditLog

Implementation of audit logging that uses the SAP CP Neo library. Makes extensive use of custom attributes to fill in useful auditing information.

Important: For performance reasons, consider to only use the audit log for logging of events such as:

• security relevant events,
• read access to sensitive personal data,
• changes to configuration data,
• and changes to personal data.

Constructor Summary

Constructors

Constructor and Description
ScpNeoAuditLog() Default constructor.
ScpNeoAuditLog(com.sap.cloud.auditlog.extension.AuditLogMessageExtensionFactory auditLogExtensionMessageFactory) Use this constructor if you want to use you own implementation of AuditLogMessageExtensionFactory.

Method Summary

Modifier and Type	Method and Description
void	logConfigChange(AccessRequester initiator, AuditedDataObject object, Throwable error, AccessedAttribute attributeAffected, AccessedAttribute... attributesAffected) Logs the change of some attributes of configuration data.
void	logConfigChangeBeginning(AccessRequester initiator, AuditedDataObject object, AccessedAttribute attributeAffected, AccessedAttribute... attributesAffected) Logs the start of a change of some attributes of configuration data.
void	logDataRead(AccessRequester initiator, AuditedDataObject object, AuditedDataSubject subject, Throwable error, AccessedAttribute attributeAffected, AccessedAttribute... attributesAffected) Logs the read access to some attributes of an object.
void	logDataReadAttempt(AccessRequester initiator, AuditedDataObject object, AuditedDataSubject subject, AccessedAttribute attributeAffected, AccessedAttribute... attributesAffected) Logs the attempt to read some attributes from an object.
void	logDataWrite(AccessRequester initiator, AuditedDataObject object, AuditedDataSubject subject, Throwable error, AccessedAttribute attributeAffected, AccessedAttribute... attributesAffected) Logs the modification of some attributes of an object.
void	logDataWriteAttempt(AccessRequester initiator, AuditedDataObject object, AuditedDataSubject subject, AccessedAttribute attributeAffected, AccessedAttribute... attributesAffected) Logs the attempt to write to some attributes of an object.
void	logSecurityEvent(AccessRequester initiator, String message, Throwable throwable) Logs a generic security event.
void	logSecurityEventBeginning(AccessRequester initiator, String message) Logs the start of a generic security event.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

ScpNeoAuditLog

public ScpNeoAuditLog()
               throws AuditLogAccessException

Default constructor. Uses the AuditLogMessageExtensionFactory implementation provided by the environment.

Throws:

AuditLogAccessException - When no implementation is provided by the environment.

ScpNeoAuditLog

public ScpNeoAuditLog(@Nonnull
                      com.sap.cloud.auditlog.extension.AuditLogMessageExtensionFactory auditLogExtensionMessageFactory)

Use this constructor if you want to use you own implementation of AuditLogMessageExtensionFactory.

Parameters:

auditLogExtensionMessageFactory - An instance of AuditLogMessageExtensionFactory.

Method Detail

logSecurityEventBeginning

public void logSecurityEventBeginning(@Nonnull
                                      AccessRequester initiator,
                                      @Nullable
                                      String message)

Logs the start of a generic security event.

Specified by:

logSecurityEventBeginning in interface AuditLog

Parameters:

initiator - Information about the user that starts performing the security event.

message - Descriptive log message.

logSecurityEvent

public void logSecurityEvent(@Nonnull
                             AccessRequester initiator,
                             @Nullable
                             String message,
                             @Nullable
                             Throwable throwable)

Logs a generic security event.

Specified by:

logSecurityEvent in interface AuditLog

Parameters:

initiator - Information about the user that performed the security event.

message - Descriptive log message.

throwable - The exception in case of an error.

logConfigChangeBeginning

public void logConfigChangeBeginning(@Nonnull
                                     AccessRequester initiator,
                                     @Nonnull
                                     AuditedDataObject object,
                                     @Nonnull
                                     AccessedAttribute attributeAffected,
                                     @Nullable
                                     AccessedAttribute... attributesAffected)

Logs the start of a change of some attributes of configuration data.

Specified by:

logConfigChangeBeginning in interface AuditLog

Parameters:

initiator - Information about the user starting to modify the configuration.

object - An instance of AuditedDataObject that represents the object that will be modified.

attributeAffected - An attribute that will be changed.

attributesAffected - An arbitrary number of attributes that will be changed.

logConfigChange

public void logConfigChange(@Nonnull
                            AccessRequester initiator,
                            @Nonnull
                            AuditedDataObject object,
                            @Nullable
                            Throwable error,
                            @Nonnull
                            AccessedAttribute attributeAffected,
                            @Nullable
                            AccessedAttribute... attributesAffected)

Logs the change of some attributes of configuration data.

Specified by:

logConfigChange in interface AuditLog

Parameters:

initiator - Information about the user modifying the configuration.

object - An instance of AuditedDataObject that represents the object that has been modified.

error - The exception in case of an error.

attributeAffected - An attribute that has been changed.

attributesAffected - An arbitrary number of attributes that have been changed.

logDataReadAttempt

public void logDataReadAttempt(@Nonnull
                               AccessRequester initiator,
                               @Nonnull
                               AuditedDataObject object,
                               @Nonnull
                               AuditedDataSubject subject,
                               @Nonnull
                               AccessedAttribute attributeAffected,
                               @Nullable
                               AccessedAttribute... attributesAffected)

Logs the attempt to read some attributes from an object.

Specified by:

logDataReadAttempt in interface AuditLog

Parameters:

initiator - Information about the user trying to the read the attributes.

object - An instance of AuditedDataObject that represents the object to be read.

subject - An instance of AuditedDataSubject that represents the owner of the data to be read.

attributeAffected - An attribute that should be read.

attributesAffected - An arbitrary number of attributes that should be read.

logDataRead

public void logDataRead(@Nonnull
                        AccessRequester initiator,
                        @Nonnull
                        AuditedDataObject object,
                        @Nonnull
                        AuditedDataSubject subject,
                        @Nullable
                        Throwable error,
                        @Nonnull
                        AccessedAttribute attributeAffected,
                        @Nullable
                        AccessedAttribute... attributesAffected)

Logs the read access to some attributes of an object.

Specified by:

logDataRead in interface AuditLog

Parameters:

initiator - Information about the user reading the attributes.

object - An instance of AuditedDataObject that represents the object that has been read.

subject - An instance of AuditedDataSubject that represents the owner of the data that has been read.

error - The exception in case of an error.

attributeAffected - An attribute that has been read.

attributesAffected - An arbitrary number of attributes that have been read.

logDataWriteAttempt

public void logDataWriteAttempt(@Nonnull
                                AccessRequester initiator,
                                @Nonnull
                                AuditedDataObject object,
                                @Nonnull
                                AuditedDataSubject subject,
                                @Nonnull
                                AccessedAttribute attributeAffected,
                                @Nullable
                                AccessedAttribute... attributesAffected)

Logs the attempt to write to some attributes of an object.

Specified by:

logDataWriteAttempt in interface AuditLog

Parameters:

initiator - Information about the user trying to write to some attributes.

object - An instance of AuditedDataObject that represents the object that is about to be modified.

subject - An instance of AuditedDataSubject that represents the owner of the data that is about to be modified.

attributeAffected - An attribute that should be modified, containing the old and new value.

attributesAffected - An arbitrary number of attributes that should be modified, containing the old and new values.

logDataWrite

public void logDataWrite(@Nonnull
                         AccessRequester initiator,
                         @Nonnull
                         AuditedDataObject object,
                         @Nonnull
                         AuditedDataSubject subject,
                         @Nullable
                         Throwable error,
                         @Nonnull
                         AccessedAttribute attributeAffected,
                         @Nullable
                         AccessedAttribute... attributesAffected)

Logs the modification of some attributes of an object.

Specified by:

logDataWrite in interface AuditLog

Parameters:

initiator - Information about the user changing the attributes.

object - An instance of AuditedDataObject that represents the object that has been modified.

subject - An instance of AuditedDataSubject that represents the owner of the data that has been modified.

error - The exception in case of an error.

attributeAffected - An attribute that has been modified, containing the old and new value.

attributesAffected - An arbitrary number of attributes that have been modified, containing the old and new values.