Logging (auditing) on Declarative Security

Question

Hi everyone,
We are using Access Manager on a J2EE project to achieve AAA (Authentication, Authorization and Auditing). Using declarative security with the Policy Agent, we achieved Authentication and Authorization, but not Auditing.
The J2EE access verifications are not logged by the Policy Agent, or anywhere in Access Manager (or, at least, so it seems). Only the explicit AM policies are logged (URL Policies etc). For instance, calls to isUserInRole, role membership checks and servlet security constraints, which are handled by the Agent Realm are not logged by AM.
is there a way to enable logging for the declarative/programmatic J2EE security?
Thank you very much.
Zica.

Answer 1

Actually, the Agent realm can log calls to isUserInRole and the user authentication, but you shall enable "message" level logs (it creates a amRealm file). The agent realm doesn't log that kind of information into the audit log.
The security constraints evaluations are executed inside the web/ejb container context, so the agent realm never knows about them. The containers usually only ask for session or identity information to the realm. The implementation depends on each vendor implementation.
Declarative security depends on the specific web application configuration, and nothing is configured or evaluated in Access Manager.
If you want to audit declarative J2ee security you have to find out what your container vendor offers to do it.
Hope it helps.