topic Re: Audit log when Document access is forbidden (User Cannot Read the Document) in Nuxeo Forum

Audit log when Document access is forbidden (User Cannot Read the Document)

Klyff_Harlley1 — Sat, 05 Mar 2016 12:38:40 GMT

How to create a Audit Log (or even a History line of Document) in Nuxeo when a User that don't have permission to read the , but try to access with a permalink?

That are some way to do by extension point?

I know is possible to do by listening events on document. (https://doc.nuxeo.com/display/NXDOC/Audit#Audit-Event)

But dont exists any event like “no_access_granted_for_document” or some other way to do?

-I think the Access Check (hasPermission) happens before the Audit be available for. I'm wrong?

Re: Audit log when Document access is forbidden (User Cannot Read the Document)

Florent_Guillau — Thu, 31 Mar 2016 13:57:56 GMT

You're right, there's no event sent when permissions checks failed and access to a document is denied. So what you're trying to do is not currently possible without changing some code inside Nuxeo.

Re: Audit log when Document access is forbidden (User Cannot Read the Document)

Klyff_Harlley1 — Thu, 31 Mar 2016 14:18:06 GMT

Hi Florent.

Yes, I thought about it. So, I'll try doing it inside AbstractSession.java (hasPermission methods), for having the event fired and a simple contrib to handle that event. It's be a good way? What do you think?

Thanks!

Re: Audit log when Document access is forbidden (User Cannot Read the Document)

Florent_Guillau — Thu, 31 Mar 2016 14:23:17 GMT

It will mostly work but please be aware that there are a number of places where DocumentException is caught and ignored, so you'll get spurious logs. For instance CoreSession.getDocuments does this, or Nuxeo Drive. Maybe DefaultNuxeoExceptionHandler or a subclass, when calling ExceptionHelper.isSecurityError, would be a better location.

Re: Audit log when Document access is forbidden (User Cannot Read the Document)

Florent_Guillau — Thu, 31 Mar 2016 14:36:41 GMT

Note that if you modify Nuxeo code you're on your own for future upgrades, it's very likely that this area of the code will change in future releases.

Re: Audit log when Document access is forbidden (User Cannot Read the Document)

Klyff_Harlley1 — Sun, 03 Apr 2016 12:41:40 GMT

Yes, I know that.

Thank you very much Florent!

Re: Audit log when Document access is forbidden (User Cannot Read the Document)

Klyff_Harlley1 — Sun, 03 Apr 2016 12:42:19 GMT

Sounds Good! I think ExceptionHelper.isSecurityError should work.