(syncope) branch master updated: Ensuring to mask all sensitive values in audit records

[ilgrosso]

This is an automated email from the ASF dual-hosted git repository.

ilgrosso pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/syncope.git


The following commit(s) were added to refs/heads/master by this push:
     new c62b1c4621 Ensuring to mask all sensitive values in audit records
c62b1c4621 is described below

commit c62b1c4621c980462e0914b6da5fc9a085d297e9
Author: Francesco Chicchiriccò <ilgro...@apache.org>
AuthorDate: Mon Aug 17 14:45:06 2026 +0200

    Ensuring to mask all sensitive values in audit records
---
 .../provisioning/java/DefaultAuditManager.java     | 49 ++++++++++++++++++++++
 1 file changed, 49 insertions(+)

diff --git 
a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAuditManager.java
 
b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAuditManager.java
index fd94060eb2..89f2cd57d8 100644
--- 
a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAuditManager.java
+++ 
b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAuditManager.java
@@ -24,9 +24,13 @@ import java.util.List;
 import java.util.Objects;
 import java.util.Optional;
 import org.apache.commons.lang3.SerializationUtils;
+import org.apache.syncope.common.keymaster.client.api.model.Domain;
 import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
+import org.apache.syncope.common.lib.to.ConnInstanceTO;
+import org.apache.syncope.common.lib.to.ResourceTO;
 import org.apache.syncope.common.lib.to.UserTO;
+import org.apache.syncope.common.lib.types.ConnConfProperty;
 import org.apache.syncope.common.lib.types.OpEvent;
 import org.apache.syncope.core.persistence.api.dao.AuditConfDAO;
 import org.apache.syncope.core.persistence.api.dao.AuditEventDAO;
@@ -50,6 +54,16 @@ public class DefaultAuditManager implements AuditManager {
 
     protected static final String MASKED_VALUE = "<MASKED>";
 
+    protected static void maskSensitive(final List<ConnConfProperty> conf) {
+        conf.stream().filter(property -> 
property.getSchema().isConfidential()).forEach(property -> {
+            int size = property.getValues().size();
+            property.getValues().clear();
+            for (int i = 0; i < size; i++) {
+                property.getValues().add(MASKED_VALUE);
+            }
+        });
+    }
+
     protected static Object maskSensitive(final Object object) {
         return switch (object) {
             case UserTO userTO -> {
@@ -57,6 +71,11 @@ public class DefaultAuditManager implements AuditManager {
                 if (clone.getPassword() != null) {
                     clone.setPassword(MASKED_VALUE);
                 }
+                clone.getLinkedAccounts().forEach(linkedAccount -> {
+                    if (linkedAccount.getPassword() != null) {
+                        linkedAccount.setPassword(MASKED_VALUE);
+                    }
+                });
                 yield clone;
             }
 
@@ -68,6 +87,11 @@ public class DefaultAuditManager implements AuditManager {
                 if (clone.getSecurityAnswer() != null) {
                     clone.setSecurityAnswer(MASKED_VALUE);
                 }
+                clone.getLinkedAccounts().forEach(linkedAccount -> {
+                    if (linkedAccount.getPassword() != null) {
+                        linkedAccount.setPassword(MASKED_VALUE);
+                    }
+                });
                 yield clone;
             }
 
@@ -79,6 +103,31 @@ public class DefaultAuditManager implements AuditManager {
                 if (clone.getSecurityAnswer() != null) {
                     clone.getSecurityAnswer().setValue(MASKED_VALUE);
                 }
+                clone.getLinkedAccounts().forEach(linkedAccountUR -> 
Optional.ofNullable(
+                        
linkedAccountUR.getLinkedAccountTO()).ifPresent(linkedAccount -> {
+
+                    if (linkedAccount.getPassword() != null) {
+                        linkedAccount.setPassword(MASKED_VALUE);
+                    }
+                }));
+                yield clone;
+            }
+
+            case ConnInstanceTO connInstanceTO -> {
+                ConnInstanceTO clone = 
SerializationUtils.clone(connInstanceTO);
+                maskSensitive(connInstanceTO.getConf());
+                yield clone;
+            }
+
+            case ResourceTO resourceTO -> {
+                ResourceTO clone = SerializationUtils.clone(resourceTO);
+                
clone.getConfOverride().ifPresent(DefaultAuditManager::maskSensitive);
+                yield clone;
+            }
+
+            case Domain domain -> {
+                Domain clone = SerializationUtils.clone(domain);
+                clone.setAdminPassword(MASKED_VALUE);
                 yield clone;
             }