Identify users in a session

You can use a session identifier plugin to add identifying information to session event reports. By default, the reports carry information about the IP address from which an event originated. Alternatively, you can write a plugin that will return an IDENT=<info> key-value pair.

You can use the Session Log Identifier field on the Operations report page to search for the identifying IP address or other information. The information is displayed in the report under the "Ident" heading.

This plugin is enabled by the SESSION IDENT PLUGIN option.

There is no shipped plugin in use with this plugin point.

Write a custom session identification plugin

Requirements

See Writing plugins for general requirements.

Execution points

When configured, this plugin is run by all modules when a user logs into Bravura Security Fabric .

Input

The plugin will receive the following input corresponding to fields in the sesslog table:

"" "" = {
  "ENVIRONMENT" "" = {
    "ALLUSERSPROFILE" = "C:\\Documents and Settings\\All Users"
    "CommonProgramFiles" = "C:\\Program Files\\Common Files"
    "COMPUTERNAME" = "MYCOMPUTER"
    "ComSpec" = "C:\\WINNT\\system32\\cmd.exe"
    "CONTENT_LENGTH" = "145"
    "CONTENT_TYPE" = "application/x-www-form-urlencoded"
    "EXCHICONS" = "C:\\Program Files\\Exchsrvr\\bin\\maildsmx.dll"
    "GATEWAY_INTERFACE" = "CGI/1.1"
    "HTTP_ACCEPT" = "image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, ⋆/⋆"
    "HTTP_ACCEPT_ENCODING" = "gzip, deflate"
    "HTTP_ACCEPT_LANGUAGE" = "en-us"
    "HTTP_CACHE_CONTROL" = "no-cache"
    "HTTP_CONNECTION" = "Keep-Alive"
    "HTTP_CONTENT_LENGTH" = "145"
    "HTTP_CONTENT_TYPE" = "application/x-www-form-urlencoded"
    "HTTP_COOKIE" = "HITACHI-ID-DEFAULT-VALUES=43d7c817-00"
    "HTTP_HOST" = "localhost"
    "HTTP_REFERER" = "https://localhost/default/"
    "HTTP_USER_AGENT" = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
    "HTTPS" = "off"
    "INSTANCE_ID" = "1"
    "LOCAL_ADDR" = "127.0.0.1"
    "NUMBER_OF_PROCESSORS" = "1"
    "OS" = "Windows_NT"
    "Os2LibPath" = "C:\\WINNT\\system32\\os2\\dll;"
    "Path" = "C:\\WINNT\\system32;C:\\WINNT;C:\\WINNT\\System32\\Wbem;C:\\PROGRA~1\\ULTRAE~1"
    "PATH_TRANSLATED" = "c:\\inetpub\\wwwroot"
    "PATHEXT" = ".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH"
    "PROCESSOR_ARCHITECTURE" = "x86"
    "PROCESSOR_IDENTIFIER" = "x86 Family 15 Model 4 Stepping 8, GenuineIntel"
    "PROCESSOR_LEVEL" = "15"
    "PROCESSOR_REVISION" = "0408"
    "ProgramFiles" = "C:\\Program Files"
    "REMOTE_ADDR" = "127.0.0.1"
    "REMOTE_HOST" = "127.0.0.1"
    "REQUEST_METHOD" = "POST"
    "SCRIPT_NAME" = "/default/"
    "SERVER_NAME" = "localhost"
    "SERVER_PORT" = "80"
    "SERVER_PORT_SECURE" = "0"
    "SERVER_PROTOCOL" = "HTTP/1.1"
    "SERVER_SOFTWARE" = "Microsoft-IIS/5.0"
    "SystemDrive" = "C:"
    "SystemRoot" = "C:\\WINNT"
    "TEMP" = "C:\\WINNT\\TEMP"
    "TMP" = "C:\\WINNT\\TEMP"
    "USERPROFILE" = "C:\\Documents and Settings\\psadmin"
     
    "windir" = "C:\\WINNT"
  }
  "SESSION" "" = {
    "HOST" = ""
    "HOSTID" = ""
    "ID" = "S382005-153PMY~h/2Z@"
    "LONGID" = "SMITHBO"
    "OPER" = "USUP"
    "REQBY" = "SMITHBO"
    "RESULT" = ""
    "RESULTCODE" = "0"
    "TEND" = "422e10d1"
    "TSTART" = "422e10d1"
    "USERID" = "SMITHBO"
  }
  "requester" "user" = {
         
    "ID" = "SMITHBO"
    "NAME" = "Bob Jon Smith"
  }
}

Output

The plugin returns:

"" "" = {
  "IDENT" = "<ip address>"
  "retval" = "0"
}

Where:

IDENT is the string to be saved in the sesslog.ident field
retval indicates success if the value is 0.

If the plugin fails (value is not 0), the user’s IP address will be stored. The optional key-value pair errmsg can be used to provide a reason for the failure.

In this section:

Identify users in a session

Write a custom session identification plugin

Search results