BUG#: 8576

TITLE: Enhance Authentication failure error messages with client IP.
DESCRIPTION: updated the authentication failures trace and logger message with client IP address.

diff --git a/src/Pegasus/Security/Authentication/BasicAuthenticationHandler.cpp b/src/Pegasus/Security/Authentication/BasicAuthenticationHandler.cpp
index c8d260370269b01b6308cafa77f2c0a11b54dff0..ed6a3441f7f10363e36e50149a6ba2740a854719 100644 (file)
--- a/src/Pegasus/Security/Authentication/BasicAuthenticationHandler.cpp
+++ b/src/Pegasus/Security/Authentication/BasicAuthenticationHandler.cpp
@@ -126,7 +126,8 @@ Boolean BasicAuthenticationHandler::authenticate(
             Logger::INFORMATION,
             MessageLoaderParms(
                 BASIC_AUTHENTICATION_FAILED_KEY,
-                BASIC_AUTHENTICATION_FAILED, badUserName));
+                BASIC_AUTHENTICATION_FAILED, badUserName,
+                authInfo->getIpAddress()));
         PEG_METHOD_EXIT();
         return false;
     }
@@ -173,7 +174,8 @@ Boolean BasicAuthenticationHandler::authenticate(
             Logger::INFORMATION,
             MessageLoaderParms(
                 BASIC_AUTHENTICATION_FAILED_KEY,
-                BASIC_AUTHENTICATION_FAILED, userName));
+                BASIC_AUTHENTICATION_FAILED, userName,
+                authInfo->getIpAddress()));
     }
 #endif
 

diff --git a/src/Pegasus/Security/Authentication/BasicAuthenticationHandler.h b/src/Pegasus/Security/Authentication/BasicAuthenticationHandler.h
index 411928e44f27fe9ec5deeab33472b0315fef2874..afab1687adfb9e1580e3e1fc392d40aa7d9a6aff 100644 (file)
--- a/src/Pegasus/Security/Authentication/BasicAuthenticationHandler.h
+++ b/src/Pegasus/Security/Authentication/BasicAuthenticationHandler.h
@@ -49,10 +49,10 @@ PEGASUS_NAMESPACE_BEGIN
 
 static const char BASIC_AUTHENTICATION_FAILED_KEY [] =
     "Security.Authentication.BasicAuthenticationHandler."
-        "BASIC_AUTHENTICATION_FAILED";
+        "BASIC_AUTHENTICATION_FAILURE";
 
 static const char BASIC_AUTHENTICATION_FAILED [] =
-    "Authentication failed for user=$0.";
+    "Authentication failed for user $0 from client IP address $1.";
 
 class PEGASUS_SECURITY_LINKAGE BasicAuthenticationHandler
     : public Authenticator

diff --git a/src/Pegasus/Security/Authentication/LocalAuthenticationHandler.cpp b/src/Pegasus/Security/Authentication/LocalAuthenticationHandler.cpp
index 8f9d428b2e535f83645fcd086ec86793d2f70f3e..0e49d9ca8f71587836809eef2c1e86dda48e09f4 100644 (file)
--- a/src/Pegasus/Security/Authentication/LocalAuthenticationHandler.cpp
+++ b/src/Pegasus/Security/Authentication/LocalAuthenticationHandler.cpp
@@ -181,9 +181,9 @@ Boolean LocalAuthenticationHandler::authenticate(
             Logger::STANDARD_LOG, System::CIMSERVER, Logger::INFORMATION,
             MessageLoaderParms(
                 "Security.Authentication.LocalAuthenticationHandler."
-                    "LOCAL_AUTHENTICATION_FAILED",
-                "Local Authentication failed for user $0.",
-                userName));
+                    "LOCAL_AUTHENTICATION_FAILURE",
+                "Local Authentication failed for user $0 from client "
+                "IP address $1.",userName,authInfo->getIpAddress()));
     }
 
     PEG_AUDIT_LOG(logLocalAuthentication(userName, authenticated));

diff --git a/src/Pegasus/Server/HTTPAuthenticatorDelegator.cpp b/src/Pegasus/Server/HTTPAuthenticatorDelegator.cpp
index 43f553d16f02555b67fc6528744722742afcd91a..5e87bc175810518132febf1427a10f0e0646d0bb 100644 (file)
--- a/src/Pegasus/Server/HTTPAuthenticatorDelegator.cpp
+++ b/src/Pegasus/Server/HTTPAuthenticatorDelegator.cpp
@@ -630,12 +630,14 @@ void HTTPAuthenticatorDelegator::handleHTTPMessage(
                             }
                             else
                             {
-                                PEG_TRACE_CSTRING(
-                                    TRC_HTTP,
-                                    Tracer::LEVEL1,
-                                    "HTTPAuthenticatorDelegator - Bailing, "
-                                        "the certificate used for "
-                                        "authentication is not valid.");
+                                PEG_TRACE((TRC_HTTP,Tracer::LEVEL1,
+                                    "HTTPAuthenticatorDelegator- Bailing,the "
+                                        "certificate used for authentication "
+                                        "is not valid for client IP address "
+                                        "%s.",
+                                    (const char*)
+                                        httpMessage->ipAddress.getCString())
+                                    );
 
                                 MessageLoaderParms msgParms(
                                     "Pegasus.Server.HTTPAuthenticatorDelegator."
@@ -660,12 +662,13 @@ void HTTPAuthenticatorDelegator::handleHTTPMessage(
                             // up the deletion but we would pick it up here
                             // when we went to look it up in the repository
 
-                            PEG_TRACE_CSTRING(
-                                TRC_HTTP,
-                                Tracer::LEVEL1,
-                                "HTTPAuthenticatorDelegator - Bailing, the "
+                            PEG_TRACE((TRC_HTTP,Tracer::LEVEL1,
+                                "HTTPAuthenticatorDelegator- Bailing,the "
                                     "certificate used for authentication is "
-                                    "not valid.");
+                                    "not valid for client IP address %s.",
+                                (const char*)
+                                    httpMessage->ipAddress.getCString()));
+                            
                             MessageLoaderParms msgParms(
                                 "Pegasus.Server.HTTPAuthenticatorDelegator."
                                     "BAD_CERTIFICATE",
@@ -698,6 +701,11 @@ void HTTPAuthenticatorDelegator::handleHTTPMessage(
 
                 if (certUserName == String::EMPTY)
                 {
+                    PEG_TRACE((TRC_HTTP,Tracer::LEVEL1,
+                        "HTTPAuthenticatorDelegator-No username is registered "
+                            "to this certificate for client IP address %s.",
+                        (const char*)httpMessage->ipAddress.getCString()));
+
                     MessageLoaderParms msgParms(
                         "Pegasus.Server.HTTPAuthenticatorDelegator."
                             "BAD_CERTIFICATE_USERNAME",

diff --git a/src/Pegasus/msg/Server/pegasusServer_en.txt b/src/Pegasus/msg/Server/pegasusServer_en.txt
index 1bafe29b49d6f27df88ac8e50a46b52202612925..898f2d34706fc9c73154aa3099ddd170d87abbe9 100644 (file)
--- a/src/Pegasus/msg/Server/pegasusServer_en.txt
+++ b/src/Pegasus/msg/Server/pegasusServer_en.txt
@@ -6533,6 +6533,7 @@ CIM server listening on HTTPS port {0}."}
         /**
         * @note  PGS17200:
         *    Substitution {0} is a user name (a string)
+        *    This message is no longer used as of version 2.10.0
         */
         Security.Authentication.BasicAuthenticationHandler.BASIC_AUTHENTICATION_FAILED:string {"PGS17200: Authentication failed for user {0}."}
 
@@ -6562,6 +6563,13 @@ CIM server listening on HTTPS port {0}."}
          */
          Security.Authentication.SecureBasicAuthenticator.APPLID_OMVSAPPL.PEGASUS_OS_ZOS:string {"PGS17204: CIM server authentication is using application ID OMVSAPPL."}
 
+        /**
+        * @note  PGS17205:
+        *    Substitution {0} is a user name (a string)
+        *    Substitution {1} is a ip address(a string)
+        */
+        Security.Authentication.BasicAuthenticationHandler.BASIC_AUTHENTICATION_FAILURE:string {"PGS17205: Authentication failed for user {0} from client IP address {1}."}
+
         // ==========================================================
         // Messages for Security LocalAuthenticationHandler
         //  Please use message prefix "PGS17400"
@@ -6577,9 +6585,17 @@ CIM server listening on HTTPS port {0}."}
         /**
         * @note  PGS17401:
         *    Substitution {0} is a user name (a string)
+        *    This message is no longer used as of version 2.10.0
         */
         Security.Authentication.LocalAuthenticationHandler.LOCAL_AUTHENTICATION_FAILED:string {"PGS17401: Local Authentication failed for user {0}."}
 
+        /**
+        * @note  PGS17402:
+        *    Substitution {0} is a user name (a string)
+        *    Substitution {1} is a ip address(a string)
+        */
+        Security.Authentication.LocalAuthenticationHandler.LOCAL_AUTHENTICATION_FAILURE:string {"PGS17402: Local Authentication failed for user {0} from client IP address {1}."}
+
         // ==========================================================
         // Messages for Security LocalAuthFile
         //  Please use message prefix "PGS17600"