Audit Sample - Show extended audit capability
---------------------------------------------
Copyright (c) 2013 ForgeRock AS
This work is licensed under a Creative Commons Attribution-
NonCommercial-NoDerivs 3.0 Unported License. See
http://creativecommons.org/licenses/by-nc-nd/3.0/

The sample demonstrates configuring a MySQL database to receive the
audit logs for access, activity, and recon using the OpenICF ScriptedSQL
connector. It can be used alongside any of the other OpenIDM samples by
copying the accompanying files into the respective directories.

The configuration files used in this sample are as follows:

* samples/audit-sample/conf/provisioner.openicf-scriptedsql.json shows the ScriptedSQL
connector configuration.
* samples/audit-sample/conf/audit.json shows how to enable audit logging on the router.
* samples/audit-sample/data/sample_audit_db.mysql provides a sample schema DDL to create
the tables in the external mysql database.
* samples/audit-samples/tools/ contains the Groovy scripts that allow the OpenICF
ScriptedSQL connector to interface with the MySQL database.

External Configuration

In this example OpenIDM communicates with an external MySQL database server.

The sample expects the following configuration for MySQL:
* The database is available on the local host.
* The database listens on port 3306.
* You can connect over the network to the database with user 'root' and password 'password'.
* MySQL serves a database called audit with tables access, activity, and recon.

The database schema is as described in the data definition language file, openidm/samples/audit-sample/data/sample_audit_db.mysql. Import the file into MySQL before running the sample.

Make sure MySQL is running.

$ mysql -u root -p < /path/to/openidm/samples/audit-sample/data/sample_audit_db.mysql
Enter password:

You will also need to install the MySQL Connector/J into the openidm/bundle directory:

$ cp mysql-connector-java--bin.jar /path/to/openidm/bundle/

Starting OpenIDM with the configuration for this sample:

$ cd /path/to/openidm
$ ./startup.sh -p samples/audit-sample

Initiate a reconciliation operation over the REST interface, as follows:

$ curl -k -H "Content-type: application/json" -u "openidm-admin:openidm-admin" -X POST "https://localhost:8443/openidm/recon?_action=recon&mapping=systemXmlfileAccounts_managedUser"

Alternatively, edit samples/audit-sample/conf/schedule-reconcile_systemXmlAccounts_managedUser.json
to enable scheduled reconciliation:

"enabled" : true,

The following curl command requests all identifiers in OpenIDM's internal
repository. Use it to see the results after reconciliation for example.

$ curl -k -u "openidm-admin:openidm-admin" "https://localhost:8443/openidm/managed/user?_queryId=query-all-ids"

Inspect the MySQL database:

mysql> select * from auditaccess;

You will see the access logs consistent with the curl commands executed.

mysql> select * from auditactivity;

You will see the activity logs consistent with the curl commands executed.

mysql> select * from auditrecon;

You will see the recon logs consistent with the curl commands executed.