We implemented a similar sounding audit log several months back (though we no longer use Hessian) - I'd be interested in seeing what you have. In our case we needed to audit all service methods invoked (and their parameters) and all data operations performed (that is, all Hibernate operations). We also wanted the ability to query against specific DTO objects and their property values, so our audit log also records object class and properties for parameters, return value, and exceptions.
Interesting, sounds pretty similar. We didn't need to audit every parameter, though.
We created an AuditLog Aspect to wrap our Service Facade. This was a logical place for us, because the Facade has a method for every use case.
We created a Filter to put the current Principal into a ThreadLocal (much like what Acegi does, but we're not using Acegi (yet)).
The AuditLog Aspect then grabs the Principal from the ThreadLocal, combines with the Method invocation, and writes it to DB.
The tricky part, and turns out easily solvable, was to determine the actual primary object being operated on.
We would have a service method such as:
resetPassword(Long id)
or
recoverPassword(String username, String email)
We needed to examine either the return values, or parameters, to find out what the "it" is we're working on. So we created some heuristic classes that can examine the return value or parameters to determine the object id. This lets us tie these audit log events back to some object in the system.
So, you can see, when we call remote methods via Hessian (or the like) we needed to propogate that Principal for audit logging to work.
Seth
-- <a href="http://www.picklematrix.net/foaf.rdf";>Seth Ladd's FOAF</a> <a href="http://www.foaf-project.org/";>What is FOAF?</a>
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/
_______________________________________________
Acegisecurity-developer mailing list
Acegisecurity-developer@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/acegisecurity-developer
