Turn on WCF Server Security Event Logging & Auditing

最新推荐文章于 2020-07-22 19:54:32 发布

转载最新推荐文章于 2020-07-22 19:54:32 发布 · 660 阅读

标签

#security #logging #wcf #server #authorization

WCF 专栏收录该内容

55 篇文章

订阅专栏

本文介绍如何通过简单配置启用WCF服务的安全事件审核，包括设置日志位置、记录级别及失败处理方式等，有助于调试安全异常。

http://intrepiddeveloper.wordpress.com/2008/08/07/security-event-logging-auditing/

Posted by intrepiddeveloper on August 7, 2008

Few days ago I was trying to debug a WCF service hosted on a remote server which was giving a very generic boilerplate security exceptions/faults. After scratching my head for sometime I decided to figure out how to enable logging these security exceptions on the server. I think for debugging purposes this is a great tool and should be the first step when hunting down an elusive bug.

Its actually pretty straight forward to enable Security event auditing in WCF. You simply need to enable this in the configuration of the service.

 
<configuration>
 
    <system .serviceModel>
 
      <behaviors>
 
        <behavior>
 
          <servicesecurityaudit auditLogLocation="Application" serviceAuthorizationAuditLevel="Failure"messageAuthenticationAuditLevel="Failure" suppressAuditFailure="true" />
 
        </behavior>
 
      </behaviors>
 
    </system>
 
  </configuration>

‘auditLogLocation‘ specifies which log to write to with possible values Default, Application and Security.

‘messageAuthenticationAuditLevel‘ & ‘serviceAuthorizationAuditLevel‘ indicated when to log the event i.e. on None ,Failure ,Success and SuccessOrFailure for message and service authorization respectively.

‘suppressAuditFailure‘ basically defines who (i.e. the service or the system) handles a AuditFailure event (like unable to write to log or log is full, etc). In case of true Audit Failures are ignored and request is processed normally.

In the Event Viewer note the source is listed as ServiceModel and message related information is logged in an un-encrypted form.