Setup user rights assignment for security log

Setup user rights assignment for security log

Overview

  • This is a feature which logs detailed information about log in/log out requests/responses to a database and/or Windows Security Log.
  • Enabling a log option (database/Windows Security Log) requires 2 steps:
    • Enable a handler for the option.
    • Set up storage: setting up database or register Identify to Windows Security Event Log.

Log to database

  • Note: This option is enabled and set up correctly by default
  • Enable the log-to-database handler by going to the WindsorAuditUserRequest.config file which can be found in the Runtime folder
  • Make sure that SqlAuditUserRequest element is uncommented.
  • The default destination database to log is the IdentifyAudit.AuditUserRequest table which is specified by the following key in web.config:
  • Although the key is set to the IdentifyAudit database by default, which is the same with the IdentityProviderAudit key, the fact that we have a separate key allows us to use another database than IdentifyAudit for storing audit data. The destination database must have two tables: Audit and AuditUserRequest. A customer can run provided script to create these tables.
  • Finally, restart Identify*Runtime.

Log to Windows Security Log

  • To enable the handler for this option, uncomment WindowsSecurityLogAuditUserRequest item and the corresponding component in the config file above.
  • Check the following link to enable logging to Security Log for custom applications: http://msdn.microsoft.com/en-us/magazine/cc163718.aspx
    1. Run the secpol.msc Microsoft Management Console (MMC) snap-in
    2. Selecting Local Policies, then selecting Audit Policy > Audit Object Access
    3. Right click and check Success & Failure
    4. In case Identify's application pool is running under a domain user account, make sure the account is added to list of users who have permission to generate security audit events:
  • For some testing purpose, where Identify is installed in DC
    1. Administrator Tools > Group Policy Management: select to edit GPM
    2. Add the user account to manage application pool to generate security audit events as above
  • On a Dev machine, open VS command prompt, go to the Tools folder and execute “IdentifySecurityLoggingMessage - register.bat” to register a logging component to Windows Security Log.
  • On a production server:
    • Start cmd as Administrator
    • Since 3.3.113, go to C:\Program Files\Safewhere\Identify\Tools and execute the “IdentifySecurityLoggingMessage - register.bat” file.But for those whose version is less than 3.3.113 , you can download this file : identifysecurityloggingmessage_-register-_register_dllonly-_can_be_used_for_production_servers.bat.zip for executing. For the older version, you don't have to input the tenant nme)
    • when the .bat file is executed, input the tenant name.
  • Important notes:
    • Do not open any Event Viewer windows while doing registration.
    • Restart ISS after finishing registration. The registration script also contains a command call to restart IIS.
    • In order to view logged events :
    • For the tenant whose version is less than 3.3.113, we canto right click on the Security log → Filter Current log → Check Identify in the Event sources drop down list.
    • For the tenant whose version is from 3.3.113, we canto right click on the Security log → Filter Current log → Check Identify with its tenant name in the Event sources drop down list.

Disable logging

  • Sometimes, one may wants to disable logging. The required steps are:
    • Comment out both WindowsSecurityLogAuditUserRequest and SqlAuditUserRequest.
    • Enable NullAuditUserRequest.
  • Hopefully we can eliminate the need to enable NullAuditUserRequest when we upgrade Identify to use a newer version of Windsor Castle.