search

GluuFederation / oxTrust

Gluu Server UI for managing authentication, authorization and users.
https://gluu.org/docs/ce
MIT License
134 stars 61 forks source link

When HTTP logging mode is enabled, oxTrust should also dump response body. #1745

Open aliaksander-samuseu opened 5 years ago

aliaksander-samuseu commented 5 years ago

At the moment, httpLoggingEnabled property in conjunction with loggingLevel makes oxTrust to dump complete HTTP request into log file on disk for easy review. That is a huge step forward in terms of troubleshooting and ease of providing support to customers that (in theory) may make usage of cumbersome complex tools like intercepting proxies and Apache's mod_dumpio not necessary in most cases.

The only downside to this currently is that this feature won't dump HTTP response's body along with the request - and this severely limiting its troubleshooting potential in many cases.

According to @yurem , such limitation was added with optimization in mind, to prevent log from consuming disk space rapidly; there also are some implementation difficulties to make that happen (but still may be possible).

Overall, I believe implementing this additional functionality may worth a try. To tackle the disk space issue at least, there could be an additional key in JSON configuration array which would allow to enable HTTP response body logging separately from the rest of the HTTP logging functionality.

aliaksander-samuseu commented 4 years ago

@yurem

I probably just copied this text for a similar oxAuth enhancement I created back then, with minor editing. But as I see now, there is actually no such option for oxTrust at all, in 4.0. Or at least we don't offer a changeable property for it in oxTrust's JSON config OOTB.

HTTP request and response logging (including bodies of both) for oxTrust would be useful when you need to troubleshoot SCIM flow, and calls to newly added oxTrust API as well. Ideally, we should have such feature.