nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

how can i capture the event of a user being added as part of an AD LDAP synch?

dbiggins

I know that I can capture the event of a user being manually added to Alfresco though the Admin Tools page in Share by auditing for a PathMap source of "/alfresco-api/post/PersonService/createPerson".

Users are typically added by an AD LDAP synchronization, however, and I can't see what event is being triggered.

An Alfresco user IS getting created after a synch. Should I be looking for something else, like membership add to a group?

I am setting the log setting of 'org.alfresco.repo.audit.inbound' to DEBUG, but am not seeing anything for that user. Any other log settings to try?

Thanks All!

Find more posts tagged with

Alfresco Content Services

Accepted answers

afaust

The same kind of API is also used during synchronisation, e.g. createPerson call is being made. Unfortunately, the person service is used in such a way that Auditing is circumvented in this use case (by using "personService" bean reference instead of "PersonService").

You could still react to the event of a person being created by using a policy which is unaffected by the choice of bean reference. A policy can be used to record your own data for Auditing. That is e.g. the way that alfresco-access works.

All comments

afaust

dbiggins

Axel,

Thanks very much!

I will a pursue behavior / policy mod that logs the event of an account being created.

Thanks also for the heads-up on the alfresco-access audit application: I will try to see how they are writing to the audit trail, as it would be ideal to have all of the audited events in one location.

dbiggins

Axel,

I have created a policy that identifies when people (ContentModel.TYPE_PERSON) are created (overriding OnCreateNodePolicy.onCreateNode), and that works fine.

Within the onCreateNode method I am trying to call 'auditComponent.recordAuditValues' to register the event, but I am not seeing anything in my audit query.

I suspect that it is because I am misunderstanding what the argument 'rootPath' is in the call:

recordAuditValues(String rootPath, Map<String,Serializable> values)

The API makes it sound like the rootPath and the values Map are combined to be what would be evaluated by the audit path mapper, but I can't seem to get the audit call to show up in audit trail.
Should the rootpath be the Audit application key?  the pathmappings target?
Thanks!
Dan

afaust

The rootPath should be the common base path for your audit event (and data) including the name of the "source audit producer" as the first path fragment to help differentiate it from other audit producers. You can use any of number of path fragments as the "source" in a PathMap within your audit configuration.

E.g. the two default Alfresco audit producers are alfresco-api and alfresco-access, so their rootPath will always begin with /alfresco-api/ and /alfresco-access/ specifically. The alfresco-api producer will include additional path fragments in the root path to differentiate the type of event, e.g. if it is a pre- or post-invocation audit, which service and which operation it refers.

I recommend NOT using the audit application key as the first path fragment in the rootPath, just to avoid the confusion / misconception that the producer + application are the same. If Alfresco had chosen this for alfresco-access there might not have been confusion about how audit filters work (e.g. what part of the data they apply to) or they would have implemented it correctly, instead of half-assed.

dbiggins

Thanks for the reply, and my apologies for the smallness of my brain...

I have an audit app defined as:

<?xml version='1.0' encoding='UTF-8'?>
<Audit
    xmlns="http://www.alfresco.org/repo/audit/model/3.2"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.alfresco.org/repo/audit/model/3.2 alfresco-audit-3.2.xsd"
    >
    <DataExtractors>
       <DataExtractor name="simpleValue" registeredName="auditModel.extractor.simpleValue"/>
    </DataExtractors>

    <PathMappings>
        <PathMap source="/alfresco-api/post/PersonService/createPerson" target="/auditcreateperson/create"/>
    </PathMappings>
    <Application name="auditcreateperson" key="auditcreateperson">
        <AuditPath key="create">
                <AuditPath key="args">
                        <AuditPath key="properties">
                                <RecordValue key="properties" dataExtractor="simpleValue" />
                        </AuditPath>
                 </AuditPath>
        </AuditPath>
    </Application>
</Audit>

, and I can query for (manually) created users with the query:

https://myserver/alfresco/service/api/audit/query/auditcreateperson?verbose=true&forward=false

which returns something like:

...
   {
      "id": 2262417,
      "application": "auditcreateperson",
      "user": "DBiggins",
      "time": "2017-03-06T10:56:22.273-05:00",
      "values": {
        "/auditcreateperson/create/args/properties/properties": "{{http://www.alfresco.org/model/content/1.0}sizeCurrent=0, {http://www.alfresco.org/model/content/1.0}userName=asd, {http://www.alfresco.org/model/content/1.0 //www.alfresco.org/model/content/1.0}email=dbiggins@myemail.com, {http://www.alfresco.org/model/content/1.0}lastName=asd, {http://www.alfresco.org/model/content/1.0}firstName=asd}"
      }
    }
...

so that would mean that my rootpath would be:

/alfresco-api/post/PersonService/createPerson

, and my map would be something like the values value?

Thanks again!

Dan