logstash-input-okta_enterprise 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8d9e8104fd93142a38dda0c356c17c2683f7c786
-  data.tar.gz: 62d0cf3957e8b6e8402b2b47464aae208a159501
+  metadata.gz: b34210b7e44a465d7076fd2e3992f0c0f456edec
+  data.tar.gz: c64c72d6963933eec6eb214eab4228e2d2bd6138
 SHA512:
-  metadata.gz: 6ec0cd5914f7af3ebb110ea5890caef8582575521a9c29bd77f3ec49a38c97d344a31d28a602c4cd6ad9d1e40915a6557a8d2f4e5ae413596eee4c8cadc49492
-  data.tar.gz: 1840ab41b09a997ea52bb6ffd503f94990f5066a5ddfb66c73ca6a2c8e36b2052685689953a73ba76d9cf086af93249f56a88bfa6ba2d88955f96415d48d8a2c
+  metadata.gz: bfa6a760c4583967263d019432138727b3d9c58c4b30195330d0a15fb5687d48032278f09c77f79627720418a5b6e77b45310de161c0aa03f64bd58c4c075af1
+  data.tar.gz: 27ef0db080a75a1a08d02a804d9359a1a112f4ca6b70123cf38e9fe1437a1fbb4ef3cc3df0efa6e38dc3c0c1e6115387f7eed86e07fc6742c94a2590ae2bbb1a

data/Gemfile

@@ -1,3 +1,11 @@
 source 'https://rubygems.org'
+
 gemspec
 
+logstash_path = ENV["LOGSTASH_PATH"] || "../../logstash"
+use_logstash_source = ENV["LOGSTASH_SOURCE"] && ENV["LOGSTASH_SOURCE"].to_s == "1"
+
+if Dir.exist?(logstash_path) && use_logstash_source
+  gem 'logstash-core', :path => "#{logstash_path}/logstash-core"
+  gem 'logstash-core-plugin-api', :path => "#{logstash_path}/logstash-core-plugin-api"
+end

data/lib/logstash/inputs/okta_enterprise.rb

@@ -209,9 +209,9 @@ class LogStash::Inputs::OktaEnterprise < LogStash::Inputs::Base
       @auth_token = @auth_token_env
     end
 
-    unless (@auth_token.index(/[^A-Za-z0-9-]/).nil?)
+    unless (@auth_token.index(/[^A-Za-z0-9\-_~]/).nil?)
       raise LogStash::ConfigurationError, "The auth_token should be" +
-        "alpha-numeric characters only, please check the token to ensure it is correct."
+        "unreserved characters only, please check the token to ensure it is correct."
     end
 
     if (@start_date and @filter)
@@ -437,15 +437,26 @@ class LogStash::Inputs::OktaEnterprise < LogStash::Inputs::Base
         end
       end
 
-      @codec.decode(response.body) do |decoded|
-        event = @target ? LogStash::Event.new(@target => decoded.to_hash) : decoded
-        apply_metadata(event, requested_url, response, exec_time)
-        decorate(event)
-        queue << event
+      if (response.body.length > 0)
+        @codec.decode(response.body) do |decoded|
+          event = @target ? LogStash::Event.new(@target => decoded.to_hash) : decoded
+          apply_metadata(event, requested_url, response, exec_time)
+          decorate(event)
+          queue << event
+        end
+      else
+        @codec.decode("{}") do |decoded|
+          event = @target ? LogStash::Event.new(@target => decoded.to_hash) : decoded
+          apply_metadata(event, requested_url, response, exec_time)
+          decorate(event)
+          queue << event
+        end
       end
+        
 
       if (Array(response.headers["link"]).count > 1)
         @continue = true
+        @logger.debug("Continue status", :continue => @continue  )
       end
 
       @logger.info("Successful response returned", :code => response.code, :headers => response.headers)
@@ -455,9 +466,9 @@ class LogStash::Inputs::OktaEnterprise < LogStash::Inputs::Base
       @codec.decode(response.body) do |decoded|
         event = @target ? LogStash::Event.new(@target => decoded.to_hash) : decoded
         apply_metadata(event, requested_url, response, exec_time)
-        event["Okta-Plugin-Status"] = "Auth_token supplied is not valid, " +
-        "validate the auth_token and update the plugin config."
-        event["HTTP-Code"] = 401
+        event.set("Okta-Plugin-Status","Auth_token supplied is not valid, " +
+        "validate the auth_token and update the plugin config.")
+        event.set("HTTP-Code",401)
         event.tag("_okta_response_error")
         decorate(event)
         queue << event
@@ -473,8 +484,8 @@ class LogStash::Inputs::OktaEnterprise < LogStash::Inputs::Base
         @codec.decode(response.body) do |decoded|
           event = @target ? LogStash::Event.new(@target => decoded.to_hash) : decoded
           apply_metadata(event, requested_url, response, exec_time)
-          event["Okta-Plugin-Status"] = "Filter string was not valid."
-          event["HTTP-Code"] = 400
+          event.set("Okta-Plugin-Status","Filter string was not valid.")
+          event.set("HTTP-Code",400)
           event.tag("_okta_response_error")
           decorate(event)
           queue << event
@@ -494,8 +505,8 @@ class LogStash::Inputs::OktaEnterprise < LogStash::Inputs::Base
         @codec.decode(response.body) do |decoded|
           event = @target ? LogStash::Event.new(@target => decoded.to_hash) : decoded
           apply_metadata(event, requested_url, response, exec_time)
-          event["Okta-Plugin-Status"] = "Date was not formatted correctly."
-          event["HTTP-Code"] = 400
+          event.set("Okta-Plugin-Status","Date was not formatted correctly.")
+          event.set("HTTP-Code",400)
           event.tag("_okta_response_error")
           decorate(event)
           queue << event
@@ -526,8 +537,8 @@ class LogStash::Inputs::OktaEnterprise < LogStash::Inputs::Base
     @codec.decode(response.body) do |decoded|
       event = @target ? LogStash::Event.new(@target => decoded.to_hash) : decoded
       apply_metadata(event, requested_url, response, exec_time)
-      event["Okta-Plugin-Status"] = "Unknown error, see Okta error"
-      event["HTTP-Code"] = response.code
+      event.set("Okta-Plugin-Status","Unknown error, see Okta error")
+      event.set("HTTP-Code",response.code)
       event.tag("_okta_response_error")
       decorate(event)
       queue << event
@@ -548,11 +559,11 @@ class LogStash::Inputs::OktaEnterprise < LogStash::Inputs::Base
 
     event = LogStash::Event.new
     apply_metadata(event, requested_url, nil, exec_time)
-    event["http_request_failure"] = {
+    event.set("http_request_failure", {
       "Okta-Plugin-Status" => "Client Connection Error",
       "Connection-Error" => exception.message,
       "backtrace" => exception.backtrace
-      }
+      })
     event.tag("_http_request_failure")
     decorate(event)
     queue << event
@@ -563,6 +574,7 @@ class LogStash::Inputs::OktaEnterprise < LogStash::Inputs::Base
   def apply_metadata(event, requested_url, response=nil, exec_time=nil)
     return unless @metadata_target
 
+    m = {}
     m = {
       "host" => @host,
       "url" => requested_url,
@@ -576,7 +588,7 @@ class LogStash::Inputs::OktaEnterprise < LogStash::Inputs::Base
       m["retry_count"] = response.times_retried
     end
 
-    event[@metadata_target] = m
+    event.set(@metadata_target,m)
 
   end
 

data/logstash-input-okta_enterprise.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name          = 'logstash-input-okta_enterprise'
-  s.version       = '0.1.0'
+  s.version       = '0.2.0'
   s.licenses      = ['Apache License (2.0)']
   s.summary       = 'This plugin fetches log events from Okta'
   s.description   = 'This plugin fetches log events from Okta'
@@ -10,7 +10,8 @@ Gem::Specification.new do |s|
   s.require_paths = ['lib']
 
   # Files
-  s.files = Dir['lib/**/*','spec/**/*','vendor/**/*','*.gemspec','*.md','CONTRIBUTORS','Gemfile','LICENSE','NOTICE.TXT']
+  s.files = Dir["lib/**/*","spec/**/*","*.gemspec","*.md","CONTRIBUTORS","Gemfile","LICENSE","NOTICE.TXT", "vendor/jar-dependencies/**/*.jar", "vendor/jar-dependencies/**/*.rb", "VERSION", "docs/**/*"]
+
    # Tests
   s.test_files = s.files.grep(%r{^(test|spec|features)/})
 
@@ -18,11 +19,12 @@ Gem::Specification.new do |s|
   s.metadata = { "logstash_plugin" => "true", "logstash_group" => "input" }
 
   # Gem dependencies
-  #s.add_runtime_dependency "logstash-core-plugin-api", ">= 1.60", "<= 2.99"
-  s.add_runtime_dependency "logstash-core", ">= 2.0.0", "< 3.0.0"
+  s.add_runtime_dependency "logstash-core-plugin-api", ">= 1.60", "<= 2.99"
   s.add_runtime_dependency 'logstash-codec-plain'
-  s.add_runtime_dependency 'stud', '>= 0.0.22'
-  s.add_runtime_dependency 'logstash-mixin-http_client', ">=2.2.4", "< 5.0.0"
+  s.add_runtime_dependency 'stud', '~> 0.0.22'
+  # Retaining logstash 2.4 compat
+  s.add_runtime_dependency 'logstash-mixin-http_client', ">= 2.2.4", "< 7.0.0"
+  #s.add_runtime_dependency 'logstash-mixin-http_client', ">= 5.2.0", "< 7.0.0"
   s.add_runtime_dependency 'manticore', ">=0.6.1"
   s.add_runtime_dependency 'rufus-scheduler', "~>3.0.9"
 

metadata

@@ -1,35 +1,35 @@
 --- !ruby/object:Gem::Specification
 name: logstash-input-okta_enterprise
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Security Risk Advisors
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2017-02-24 00:00:00.000000000 Z
+date: 2017-09-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.0
-    - - "<"
+        version: '1.60'
+    - - "<="
       - !ruby/object:Gem::Version
-        version: 3.0.0
-  name: logstash-core
+        version: '2.99'
+  name: logstash-core-plugin-api
   prerelease: false
   type: :runtime
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.0
-    - - "<"
+        version: '1.60'
+    - - "<="
       - !ruby/object:Gem::Version
-        version: 3.0.0
+        version: '2.99'
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
     requirements:
@@ -47,7 +47,7 @@ dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 0.0.22
   name: stud
@@ -55,7 +55,7 @@ dependencies:
   type: :runtime
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 0.0.22
 - !ruby/object:Gem::Dependency
@@ -66,7 +66,7 @@ dependencies:
         version: 2.2.4
     - - "<"
       - !ruby/object:Gem::Version
-        version: 5.0.0
+        version: 7.0.0
   name: logstash-mixin-http_client
   prerelease: false
   type: :runtime
@@ -77,7 +77,7 @@ dependencies:
         version: 2.2.4
     - - "<"
       - !ruby/object:Gem::Version
-        version: 5.0.0
+        version: 7.0.0
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
     requirements: