Gaurav's Monologue

on Software Architecture, .NET Framework and Connected System Technology

Security Event Logging & Auditing

Posted by intrepiddeveloper on August 7, 2008

Few days ago I was trying to debug a WCF service hosted on a remote server which was giving a very generic boilerplate security exceptions/faults. After scratching my head for sometime I decided to figure out how to enable logging these security exceptions on the server. I think for debugging purposes this is a great tool and should be the first step when hunting down an elusive bug.

Its actually pretty straight forward to enable Security event auditing in WCF. You simply need to enable this in the configuration of the service.

<configuration>
    <system .serviceModel>
      <behaviors>
        <behavior>
          <servicesecurityaudit auditLogLocation="Application" serviceAuthorizationAuditLevel="Failure" messageAuthenticationAuditLevel="Failure" suppressAuditFailure="true" />
        </behavior>
      </behaviors>
    </system>
  </configuration>

auditLogLocation‘ specifies which log to write to with possible values Default, Application and Security.

messageAuthenticationAuditLevel‘  & ‘serviceAuthorizationAuditLevel‘ indicated when to log the event i.e. on None ,Failure ,Success and SuccessOrFailure for message and service authorization respectively.

suppressAuditFailure‘ basically defines who (i.e. the service or the system) handles a AuditFailure event (like unable to write to log or log is full, etc). In case of true Audit Failures are ignored and request is processed normally.

In the Event Viewer note the source is listed as ServiceModel and message related information is logged in an un-encrypted form.

About these ads

One Response to “Security Event Logging & Auditing”

  1. […] is a much more detailed explanation of how to use this feature: http://intrepiddeveloper.wordpress.com/2008/08/07/security-event-logging-auditing/ . Many thanks go to Gaurav Pandey for his useful write-up […]

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
Follow

Get every new post delivered to your Inbox.

%d bloggers like this: