(syncope) branch 4_1_X updated: Ensuring to mask all sensitive values in audit records

[ilgrosso]

This is an automated email from the ASF dual-hosted git repository.

ilgrosso pushed a commit to branch 4_1_X
in repository https://gitbox.apache.org/repos/asf/syncope.git


The following commit(s) were added to refs/heads/4_1_X by this push:
     new 94f9b83d31 Ensuring to mask all sensitive values in audit records
94f9b83d31 is described below

commit 94f9b83d3170cfe1cca9005ba846f9b74306ecbe
Author: Francesco Chicchiriccò <ilgro...@apache.org>
AuthorDate: Mon Aug 17 14:45:06 2026 +0200

    Ensuring to mask all sensitive values in audit records
---
 .../provisioning/java/DefaultAuditManager.java     | 49 ++++++++++++++++++++++
 .../java/data/ResourceDataBinderImpl.java          |  1 +
 2 files changed, 50 insertions(+)

diff --git 
a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAuditManager.java
 
b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAuditManager.java
index b28a72c09f..9b1ba66113 100644
--- 
a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAuditManager.java
+++ 
b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAuditManager.java
@@ -23,9 +23,13 @@ import java.util.Arrays;
 import java.util.List;
 import java.util.Optional;
 import org.apache.commons.lang3.SerializationUtils;
+import org.apache.syncope.common.keymaster.client.api.model.Domain;
 import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
+import org.apache.syncope.common.lib.to.ConnInstanceTO;
+import org.apache.syncope.common.lib.to.ResourceTO;
 import org.apache.syncope.common.lib.to.UserTO;
+import org.apache.syncope.common.lib.types.ConnConfProperty;
 import org.apache.syncope.common.lib.types.OpEvent;
 import org.apache.syncope.core.persistence.api.dao.AuditConfDAO;
 import org.apache.syncope.core.persistence.api.dao.AuditEventDAO;
@@ -49,6 +53,16 @@ public class DefaultAuditManager implements AuditManager {
 
     protected static final String MASKED_VALUE = "<MASKED>";
 
+    protected static void maskSensitive(final List<ConnConfProperty> conf) {
+        conf.stream().filter(property -> 
property.getSchema().isConfidential()).forEach(property -> {
+            int size = property.getValues().size();
+            property.getValues().clear();
+            for (int i = 0; i < size; i++) {
+                property.getValues().add(MASKED_VALUE);
+            }
+        });
+    }
+
     protected static Object maskSensitive(final Object object) {
         return switch (object) {
             case UserTO userTO -> {
@@ -56,6 +70,11 @@ public class DefaultAuditManager implements AuditManager {
                 if (clone.getPassword() != null) {
                     clone.setPassword(MASKED_VALUE);
                 }
+                clone.getLinkedAccounts().forEach(linkedAccount -> {
+                    if (linkedAccount.getPassword() != null) {
+                        linkedAccount.setPassword(MASKED_VALUE);
+                    }
+                });
                 yield clone;
             }
 
@@ -67,6 +86,11 @@ public class DefaultAuditManager implements AuditManager {
                 if (clone.getSecurityAnswer() != null) {
                     clone.setSecurityAnswer(MASKED_VALUE);
                 }
+                clone.getLinkedAccounts().forEach(linkedAccount -> {
+                    if (linkedAccount.getPassword() != null) {
+                        linkedAccount.setPassword(MASKED_VALUE);
+                    }
+                });
                 yield clone;
             }
 
@@ -78,6 +102,31 @@ public class DefaultAuditManager implements AuditManager {
                 if (clone.getSecurityAnswer() != null) {
                     clone.getSecurityAnswer().setValue(MASKED_VALUE);
                 }
+                clone.getLinkedAccounts().forEach(linkedAccountUR -> 
Optional.ofNullable(
+                        
linkedAccountUR.getLinkedAccountTO()).ifPresent(linkedAccount -> {
+
+                    if (linkedAccount.getPassword() != null) {
+                        linkedAccount.setPassword(MASKED_VALUE);
+                    }
+                }));
+                yield clone;
+            }
+
+            case ConnInstanceTO connInstanceTO -> {
+                ConnInstanceTO clone = 
SerializationUtils.clone(connInstanceTO);
+                maskSensitive(connInstanceTO.getConf());
+                yield clone;
+            }
+
+            case ResourceTO resourceTO -> {
+                ResourceTO clone = SerializationUtils.clone(resourceTO);
+                
clone.getConfOverride().ifPresent(DefaultAuditManager::maskSensitive);
+                yield clone;
+            }
+
+            case Domain domain -> {
+                Domain clone = SerializationUtils.clone(domain);
+                clone.setAdminPassword(MASKED_VALUE);
                 yield clone;
             }
 
diff --git 
a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ResourceDataBinderImpl.java
 
b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ResourceDataBinderImpl.java
index 64166870bb..4f91058a6f 100644
--- 
a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ResourceDataBinderImpl.java
+++ 
b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ResourceDataBinderImpl.java
@@ -598,6 +598,7 @@ public class ResourceDataBinderImpl implements 
ResourceDataBinder {
                 ? null : resource.getProvisionSorter().getKey());
 
         // do not export confidential property values
+        resourceTO.setConfOverride(resource.getConfOverride());
         resourceTO.getConfOverride().ifPresent(conf -> conf.stream().
                 filter(property -> property.getSchema().isConfidential()
                         || 
GuardedString.class.getName().equals(property.getSchema().getType())).