Fix remote address extraction in audit event origin string

[gdgenchev]

Summary

Fixes an issue in the audit event origin builder where Authentication.getDetails() was unconditionally cast to String to extract the remoteAddress.

When details was an object type (e.g., UaaAuthenticationDetails or OAuth2AuthenticationDetails), this cast raised a ClassCastException. The exception was swallowed by a broad catch block that appended details.toString() directly to the audit log. This resulted in a possible issue:

Data Leakage / Contamination: Internal state (such as token values, request parameters, and map contents) was leaked into audit logs, often mixing unrelated sources into a single line.

Example (Before)

For an OAuth2AuthenticationDetails instance, the log line improperly included the full toString() dump along with appended token inspector fields:

Audit: GroupModifiedEvent ('{"role_collection":"evenRC1771046947","op":"add_saml_attribute","saml_entity":"iot-idp-1771046947","attribute":"Groups","value":"even"}'): principal=evenRC1771046947, origin=[client=admin, details=(remoteAddress=172.18.0.1, sessionId=<SESSION>, tokenType=Bearer, tokenValue=<TOKEN>, sub=admin, iss=http://localhost:8080/uaa/oauth/token)], identityZoneId=[uaa]

The remoteAddress/sessionId/tokenType/tokenValue fragment came from the details object's toString, then sub/iss were appended by the token inspector — a shape that mixed two unrelated sources into one line.

---

Changes

Replaced the aggressive cast-and-catch approach with pattern-matching switch logic that reads the remoteAddress field safely depending on the runtime type of details:

• UaaAuthenticationDetails, OAuth2AuthenticationDetails, WebAuthenticationDetails: Directly invokes their respective accessor methods (getOrigin() / getRemoteAddress()).
• Map: Reads the remoteAddress key (supports ResourceOwnerPasswordTokenGranter and ensures forward compatibility).
• String: Parsed as JSON to look for remoteAddress. Non-JSON strings fall through safely.
• Fallback / Unknown Types: Non-matching types, missing keys, and null fields gracefully fall through without emitting a field, preventing arbitrary state dumps.

Side effect: sessionId=<SESSION> marker is dropped

The sessionId=<SESSION> marker previously present in audit origins only appeared via the buggy toString()-dump path. Its value was a hardcoded literal — not a session identifier — so it carried no correlation or lookup signal. type=UaaAuthenticationDetails in the same origin line already conveys "session-shaped auth," making the marker redundant.

AuditCheckMockMvcTests is updated accordingly:

• sessionId=<SESSION> assertions are removed.
• assertLogMessageWithSession and assertLogMessageWithoutSession collapse into a single assertLogMessage helper (they are now equivalent).

---

Test Coverage

Added unit tests in AbstractUaaEventTest covering:

• Supported Details Types: UaaAuthenticationDetails and OAuth2AuthenticationDetails — remoteAddress extraction via typed accessors.
• Map Handling: Both present and absent remoteAddress key paths, verifying map contents are not leaked.
• String Edge Cases: Valid JSON strings, non-JSON strings, and JSON with null remoteAddress.
• Origin Shape: Verification of the combined client + user origin shape in audit output.

[gdgenchev]

@tack-sap, do you remember why sessionId=<SESSION> was pinned across the audit tests in 334a8cb? From the code it looks like it was added specifically to mask the raw session id in the log output due to security concerns — is that right, or was there a downstream consumer (SIEM / compliance / parser) relying on the literal sessionId=<SESSION> string being present?

Context: I'm implementing custom audit logging on our side and used cf-uaa as reference. AI noticed a ClassCastException in the origin builder where Authentication.getDetails() gets cast to String unconditionally — for UaaAuthenticationDetails / OAuth2AuthenticationDetails the cast fails, the broad catch swallows it, and the raw Object.toString() gets dumped into the audit line (possibly leaking all toString() details)

[Copilot]

Pull request overview

Fixes audit event origin construction to safely extract remoteAddress from Authentication.getDetails() across multiple runtime shapes, avoiding ClassCastException and preventing audit-log contamination from details.toString() dumps.

Changes:

• Replaces cast-and-catch parsing with type-based extraction for remoteAddress (including JSON-string and Map support).
• Adds/updates unit tests to ensure details content is not leaked into audit origin strings.
• Updates MockMvc audit tests to stop asserting the legacy sessionId=<SESSION> marker.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
server/src/main/java/org/cloudfoundry/identity/uaa/audit/event/AbstractUaaEvent.java	Introduces type-based remoteAddress extraction and removes reliance on details.toString() fallbacks.
server/src/test/java/org/cloudfoundry/identity/uaa/audit/event/AbstractUaaEventTest.java	Adds coverage for new origin-shaping behaviors across multiple details types.
uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/audit/AuditCheckMockMvcTests.java	Updates audit expectations to match the new origin format (removing sessionId=<SESSION> assumptions).

[strehle]

@gdgenchev we will release soon, so if you want cleanup your PR and then we can take it with release

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

server/src/main/java/org/cloudfoundry/identity/uaa/audit/event/AbstractUaaEvent.java:148

• Logging a WARN for every unhandled Authentication.details type in getOrigin can generate a lot of noise in production (audit origin is built for many events, and new auth mechanisms may introduce other detail types). Consider lowering this to DEBUG or removing it to avoid log spam.

            default -> {
                logger.warn("Unhandled Authentication.details type in audit origin: {}", details.getClass().getName());
                yield Optional.empty();
            }