Examples with AuditEvent org.graylog2.audit.jersey.AuditEvent used on opensource projects

Example 76 with AuditEvent

use of org.graylog2.audit.jersey.AuditEvent in project graylog2-server by Graylog2.

the class UsersResource method changePassword.

@PUT
@Path("{username}/password")
@ApiOperation("Update the password for a user.")
@ApiResponses({ @ApiResponse(code = 204, message = "The password was successfully updated. Subsequent requests must be made with the new password."), @ApiResponse(code = 400, message = "The new password is missing, or the old password is missing or incorrect."), @ApiResponse(code = 403, message = "The requesting user has insufficient privileges to update the password for the given user."), @ApiResponse(code = 404, message = "User does not exist.") })
@AuditEvent(type = AuditEventTypes.USER_PASSWORD_UPDATE)
public void changePassword(@ApiParam(name = "username", value = "The name of the user whose password to change.", required = true) @PathParam("username") String username, @ApiParam(name = "JSON body", value = "The old and new passwords.", required = true) @Valid ChangePasswordRequest cr) throws ValidationException {
    final User user = userService.load(username);
    if (user == null) {
        throw new NotFoundException("Couldn't find user " + username);
    }
    if (!getSubject().isPermitted(RestPermissions.USERS_PASSWORDCHANGE + ":" + user.getName())) {
        throw new ForbiddenException("Not allowed to change password for user " + username);
    }
    if (user.isExternalUser()) {
        final String msg = "Cannot change password for LDAP user.";
        LOG.error(msg);
        throw new ForbiddenException(msg);
    }
    boolean checkOldPassword = true;
    // the rationale is to prevent accidental or malicious change of admin passwords (e.g. to prevent locking out legitimate admins)
    if (getSubject().isPermitted(RestPermissions.USERS_PASSWORDCHANGE + ":*")) {
        if (username.equals(getSubject().getPrincipal())) {
            LOG.debug("User {} is allowed to change the password of any user, but attempts to change own password. Must supply the old password.", getSubject().getPrincipal());
            checkOldPassword = true;
        } else {
            LOG.debug("User {} is allowed to change the password for any user, including {}, ignoring old password", getSubject().getPrincipal(), username);
            checkOldPassword = false;
        }
    }
    boolean changeAllowed = false;
    if (checkOldPassword) {
        if (user.isUserPassword(cr.oldPassword())) {
            changeAllowed = true;
        }
    } else {
        changeAllowed = true;
    }
    if (changeAllowed) {
        user.setPassword(cr.password());
        userService.save(user);
    } else {
        throw new BadRequestException("Old password is missing or incorrect.");
    }
}

Example 77 with AuditEvent

use of org.graylog2.audit.jersey.AuditEvent in project graylog2-server by Graylog2.

the class InputsResource method create.

@POST
@Timed
@ApiOperation(value = "Launch input on this node", response = InputCreated.class)
@ApiResponses(value = { @ApiResponse(code = 404, message = "No such input type registered"), @ApiResponse(code = 400, message = "Missing or invalid configuration"), @ApiResponse(code = 400, message = "Type is exclusive and already has input running") })
@RequiresPermissions(RestPermissions.INPUTS_CREATE)
@AuditEvent(type = AuditEventTypes.MESSAGE_INPUT_CREATE)
public Response create(@ApiParam(name = "JSON body", required = true) @Valid @NotNull InputCreateRequest lr) throws ValidationException {
    try {
        // TODO Configuration type values need to be checked. See ConfigurationMapConverter.convertValues()
        final MessageInput messageInput = messageInputFactory.create(lr, getCurrentUser().getName(), lr.node());
        messageInput.checkConfiguration();
        final Input input = this.inputService.create(messageInput.asMap());
        final String newId = inputService.save(input);
        final URI inputUri = getUriBuilderToSelf().path(InputsResource.class).path("{inputId}").build(newId);
        return Response.created(inputUri).entity(InputCreated.create(newId)).build();
    } catch (NoSuchInputTypeException e) {
        LOG.error("There is no such input type registered.", e);
        throw new NotFoundException("There is no such input type registered.", e);
    } catch (ConfigurationException e) {
        LOG.error("Missing or invalid input configuration.", e);
        throw new BadRequestException("Missing or invalid input configuration.", e);
    }
}

Example 78 with AuditEvent

use of org.graylog2.audit.jersey.AuditEvent in project graylog2-server by Graylog2.

the class StaticFieldsResource method create.

@POST
@Timed
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@ApiOperation(value = "Add a static field to an input")
@ApiResponses(value = { @ApiResponse(code = 404, message = "No such input on this node."), @ApiResponse(code = 400, message = "Field/Key is reserved."), @ApiResponse(code = 400, message = "Missing or invalid configuration.") })
@AuditEvent(type = AuditEventTypes.STATIC_FIELD_CREATE)
public Response create(@ApiParam(name = "inputId", required = true) @PathParam("inputId") String inputId, @ApiParam(name = "JSON body", required = true) @Valid @NotNull CreateStaticFieldRequest csfr) throws NotFoundException, ValidationException {
    checkPermission(RestPermissions.INPUTS_EDIT, inputId);
    final MessageInput input = persistedInputs.get(inputId);
    if (input == null) {
        final String msg = "Input <" + inputId + "> not found.";
        LOG.error(msg);
        throw new javax.ws.rs.NotFoundException(msg);
    }
    // Check if key is a valid message key.
    if (!Message.validKey(csfr.key())) {
        final String msg = "Invalid key: [" + csfr.key() + "]";
        LOG.error(msg);
        throw new BadRequestException(msg);
    }
    if (Message.RESERVED_FIELDS.contains(csfr.key()) && !Message.RESERVED_SETTABLE_FIELDS.contains(csfr.key())) {
        final String message = "Cannot add static field. Field [" + csfr.key() + "] is reserved.";
        LOG.error(message);
        throw new BadRequestException(message);
    }
    input.addStaticField(csfr.key(), csfr.value());
    final Input mongoInput = inputService.find(input.getPersistId());
    inputService.addStaticField(mongoInput, csfr.key(), csfr.value());
    final String msg = "Added static field [" + csfr.key() + "] to input <" + inputId + ">.";
    LOG.info(msg);
    activityWriter.write(new Activity(msg, StaticFieldsResource.class));
    final URI inputUri = getUriBuilderToSelf().path(InputsResource.class).path("{inputId}").build(mongoInput.getId());
    return Response.created(inputUri).build();
}

Example 79 with AuditEvent

use of org.graylog2.audit.jersey.AuditEvent in project graylog2-server by Graylog2.

the class StaticFieldsResource method delete.

@DELETE
@Timed
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@ApiOperation(value = "Remove static field of an input")
@ApiResponses(value = { @ApiResponse(code = 404, message = "No such input on this node."), @ApiResponse(code = 404, message = "No such static field.") })
@Path("/{key}")
@AuditEvent(type = AuditEventTypes.STATIC_FIELD_DELETE)
public void delete(@ApiParam(name = "Key", required = true) @PathParam("key") String key, @ApiParam(name = "inputId", required = true) @PathParam("inputId") String inputId) throws NotFoundException {
    checkPermission(RestPermissions.INPUTS_EDIT, inputId);
    MessageInput input = persistedInputs.get(inputId);
    if (input == null) {
        final String msg = "Input <" + inputId + "> not found.";
        LOG.error(msg);
        throw new javax.ws.rs.NotFoundException(msg);
    }
    if (!input.getStaticFields().containsKey(key)) {
        final String msg = "No such static field [" + key + "] on input <" + inputId + ">.";
        LOG.error(msg);
        throw new javax.ws.rs.NotFoundException(msg);
    }
    input.getStaticFields().remove(key);
    Input mongoInput = inputService.find(input.getPersistId());
    inputService.removeStaticField(mongoInput, key);
    final String msg = "Removed static field [" + key + "] of input <" + inputId + ">.";
    LOG.info(msg);
    activityWriter.write(new Activity(msg, StaticFieldsResource.class));
}

Example 80 with AuditEvent

use of org.graylog2.audit.jersey.AuditEvent in project graylog2-server by Graylog2.

the class SystemJobResource method cancel.

@DELETE
@Timed
@Path("/{jobId}")
@ApiOperation(value = "Cancel running job")
@Produces(MediaType.APPLICATION_JSON)
@AuditEvent(type = AuditEventTypes.SYSTEM_JOB_STOP)
public SystemJobSummary cancel(@ApiParam(name = "jobId", required = true) @PathParam("jobId") @NotEmpty String jobId) {
    SystemJob systemJob = systemJobManager.getRunningJobs().get(jobId);
    if (systemJob == null) {
        throw new NotFoundException("No system job with ID <" + jobId + "> found");
    }
    checkPermission(RestPermissions.SYSTEMJOBS_DELETE, systemJob.getClassName());
    if (systemJob.isCancelable()) {
        systemJob.requestCancel();
    } else {
        throw new ForbiddenException("System job with ID <" + jobId + "> cannot be cancelled");
    }
    return SystemJobSummary.create(UUID.fromString(systemJob.getId()), systemJob.getDescription(), systemJob.getClassName(), systemJob.getInfo(), nodeId.toString(), systemJob.getStartedAt(), systemJob.getProgress(), systemJob.isCancelable(), systemJob.providesProgress());
}