Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Disable auditing infrastructure by default

Browse Source 
Prior to this commit, the audit auto-configuration provided
an `InMemoryAuditEventRepository` bean. This commit changes the auto-config
so that an `AuditEventRepository` is not provided and instead the auto-config
is conditional on the presence of a `AuditEventRepository` bean. This is done
to encourage the use of a custom implementation of `AuditEventRepository`
since the in-memory one is quite limited and not suitable for production.
A flag is available if the auto-configuration needs to be turned off even
in the presence of a bean.

Closes gh-16110
This commit is contained in:
Madhura Bhave
2019-05-03 13:42:04 -07:00
parent e2b15c3f2a
commit 07d6eb6397
7 changed files with 124 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
spring-boot-project/spring-boot-docs/src/main/asciidoc/production-ready-features.adoc
View File

@@ -2200,12 +2200,23 @@ maximum size for the "Metaspace", you could add an additional `tag=id:Metaspace`
Once Spring Security is in play, Spring Boot Actuator has a flexible audit framework that
publishes events (by default, "`authentication success`", "`failure`" and
"`access denied`" exceptions). This feature can be very useful for reporting and for
implementing a lock-out policy based on authentication failures. To customize published
security events, you can provide your own implementations of
implementing a lock-out policy based on authentication failures.
Auditing can be enabled by providing a bean of type `AuditEventRepository` in your application's
configuration. For convenience, Spring Boot offers an `InMemoryAuditEventRepository`.
`InMemoryAuditEventRepository` has limited capabilities and we recommend using it only for development
environments. For production environments, consider creating your own alternative `AuditEventRepository`
implementation.
[[production-ready-auditing-custom]]
=== Custom Auditing
To customize published security events, you can provide your own implementations of
`AbstractAuthenticationAuditListener` and `AbstractAuthorizationAuditListener`.
You can also use the audit services for your own business events. To do so, either inject
the existing `AuditEventRepository` into your own components and use that directly or
the `AuditEventRepository` bean into your own components and use that directly or
publish an `AuditApplicationEvent` with the Spring `ApplicationEventPublisher` (by
implementing `ApplicationEventPublisherAware`).