Skip to main content

This content is closed to future replies and is no longer being maintained or updated.
Links may no longer function. If you have a similar request, please write a new post.

Question

 Maarten Veger (MaartenV9058)
Rabobank
Lead BPM Architect & Pega CLSA
Rabobank
NL
MaartenV9058 Member since 2014 6 posts
Rabobank
Posted: Feb 16, 2018
Last activity: Mar 9, 2018
Posted: 16 Feb 2018 9:19 EST
Last activity: 9 Mar 2018 13:52 EST
Closed

How to make sure download of the log-files with direct URL requires authentication?

If you go to the Log landing page and open the Log Files, you can actually see a direct URL to log files. For example, the PegaRULES.log file can be downloaded using the following direct URL:

http://hostname/prweb/DiagnosticData?logType=PEGA&format=text

If you just type in this URL, it's also possible to download the log file without authentication (on a production system). This is at least also possible in Pega version 7.3.0.

According to this article https://pdn.pega.com/support-articles/pega-authentication-requirement-log-download , this seems to be an enhancement but we had a security finding on this.

Is there a way to configure this to make sure this authentication is used to download the log files? If not, any other recommendations to secure the log files?

To see attachments, please log in.
Security
System Administration
Installation and Deployment

  • Sridevi Kakolu
Posted: 7 years ago
Posted: 17 Feb 2018 2:46 EST
Adithya Kurmachalam (Adithya1)
Pegasystems Inc.
Solutions Engineer
Pegasystems Inc.
IN

Hi,

 

By default, DiagnosticData is mapped to pegadiagnosticuser role within the application server.

When a user accesses the url which has call to DiagnosticData servlet, then basic authentication popup comes and when enter the credentials of pegadiagnosticuser role, then only you will be able to access the resources.

See web.xml in prweb application(inside prweb/WEB-INF)

Here is the servet mapping(default)

Show More

Hi,

 

By default, DiagnosticData is mapped to pegadiagnosticuser role within the application server.

When a user accesses the url which has call to DiagnosticData servlet, then basic authentication popup comes and when enter the credentials of pegadiagnosticuser role, then only you will be able to access the resources.

See web.xml in prweb application(inside prweb/WEB-INF)

Here is the servet mapping(default)

<servlet>
<servlet-name>DiagnosticData</servlet-name>
<display-name>DiagnosticData</display-name>
<description>A servlet used to serve files requested by a JMX client</description>
<servlet-class>com.pega.pegarules.internal.web.servlet.DiagnosticDataBoot</servlet-class>
</servlet>
 
<servlet-mapping>
<servlet-name>DiagnosticData</servlet-name>
<url-pattern>/DiagnosticData</url-pattern>
</servlet-mapping>
 
and here is the security constraint:
<security-constraint>
<web-resource-collection>
<web-resource-name>Diagnostic Data</web-resource-name>
<description>Serves diagnostic files generated by the JMX client</description>
<url-pattern>/DiagnosticData</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>PegaDiagnosticUser</role-name>
</auth-constraint>
</security-constraint>
 
Define this role in application server to have authorized access to DiagnoticData servlet.
 
The document mentioned is talking about integrating this authentication with SSO or with Pega operator since this authentication is currently based on application server role.
 
Thank you,
Adithya

Show Less
To see attachments, please log in.
Posted: 7 years ago
Posted: 23 Feb 2018 9:03 EST
Maarten Veger (MaartenV9058)
Rabobank
Lead BPM Architect & Pega CLSA
Rabobank
NL

Hi Adithya,

thanks for you answer. I have some dependency in making the change, but once this is done I'll react how we configured it.

To see attachments, please log in.

We'd prefer it if you saw us at our best.

Pega Collaboration Center has detected you are using a browser which may prevent you from experiencing the site as intended. To improve your experience, please update your browser.

Close Deprecation Notice