topic Re: How can i audit Webscript in Alfresco Archive

How can i audit Webscript

wajdi_ghribi — Wed, 19 Aug 2015 14:49:02 GMT

Hi,I would like to know how can i audit Webscripts, i implemented a webscript that extends AbstractWebScript, i added @auditable to the execute method and activated the audit :audit.enabled=trueaudit.alfresco-access.enabled=true‍‍‍ but still not getting the action audited, any help please.

Re: How can i audit Webscript

afaust — Wed, 19 Aug 2015 16:37:10 GMT

Hello,

there currently is not support for auditing web scripts via the @Auditable annotation. The @Auditable annotation is intended to be used on service interfaces that are then configured to use a "public proxy bean" where a special AOP interceptor processes the interface and its annotations. Web scripts already are implementations and are hard to be converted into the same type of "public proxy" and "private implementation" architecture like services.

You can still manually record audit data from your web script code by using the AuditComponent.recordAuditValues operation. In fact, that is the same API that the AOP interceptor handling the @Auditable annotation uses to record alfresco-api audit events. You could create a new custom base class for all your web scripts that always audits web script invocation, and use subclasses of this for your actual web scripts. That way you wouldn't need any annotation, but could still use it to configure what gets recorded. E.g. you could define what URL parameters get audited as "input" and what elements of the web script model are audited as "output". I wouldn't recommend auditing the rendered response as "output" though as this would surely explode your DB storage requirements quickly…

Regards
Axel

Re: How can i audit Webscript

wajdi_ghribi — Thu, 20 Aug 2015 10:15:00 GMT

Thanks AFaust, problem solved by auditing manually, if i'm getting well the idea of using the @Auditable annotation, to audit your specific service you should create an interface which contains methods with the annotation @Auditable and then you configure the proxy interceptor bean, like that every time we call a method from classes that implement our interface, the method "invoke" of the interceptor bean will be called, the method "invoke" normally contains a test something like: "if there is an "auditable" annotation on the invoked method call the AuditComponent.recordAuditValues operation".

Re: How can i audit Webscript

afaust — Mon, 24 Aug 2015 07:26:49 GMT

Basically yes - but there already is such an interceptor class, the AuditMethodInterceptor.