Do the Login & Logout events exist and are they exploitable with ScriptRunner?

[Dylan Pokun]

Environment : Cloud (Confluence, JSD, JSW)

Hello everyone,

The events I'm finding in the documentations are related to the Atlassian tooling (issues, pages, etc.). 

I can't seem to find the answer so here is the question : can I use ScriptRunner to trigger an action on login / on logout ? 

About the use-cases:

- For the login, I'm trying to exploit some custom SAML attributes that I'm receiving from an identity provider on login (I'm using SAML SSO).

- For the logout, I want to call an API to notify the identity provider that the user logged-out (there's no logout binding).

Thank you all in advance,

Regards,

Dylan

[Peter-Dave Sheehan · Accepted solution]

I've been able to trigger some actions on login event.

But I am not sure how you would tie in your login event script with the SAML attributes unless you can make some api call back to your saml idp and retrieve those attributes again.

However, with SAML SSO (reichert solution) I am not detecting any logout event.

If you can't do logout binding, perhaps you can trick your system by hiding the default logout link, and substitute your own that would go to a scriptrunner rest api and after your script runs, you redirect the user to the default logout page.

[Peter-Dave Sheehan]

Looks like I am able to detect the logout even if I disable the Logout Redirection  from my SAML plugin.

[Dylan Pokun]

Hi @Peter-Dave Sheehan and thanks!

Your answers are quite encouraging for the current investigation and I thank you very much for the side-tips about the use-cases.

I'd like to know where you went to detect the events / how you did it. Can you redirect me to some documentation please ? I can't seem to go further than manipulating existing events in the "Script Listeners" tab / testing code in the "Script Console" tab.

Thanks a lot again,

Regards,

Dylan

[Peter-Dave Sheehan]

Well, the Script Listener tab is where you want to be.

1. Create a new custom script listener,
2. select LoginEvent or LogoutEvent in the  Events to listen too,
3. Write a script for what you want to do when that event is detected

In my case all I did was write a line of text to the log:

Then I tailed the log while logging out with a test account and saw that line go in the log.

Both the LoginEvent and the LogoutEvent generate an UserEvent (as subclasses). 

You can see the documentation for those event classes here: https://docs.atlassian.com/software/jira/docs/api/8.11.1/com/atlassian/jira/event/user/UserEvent.html

You will see that there isn't a whole lot of information in those classes, but at least the user is there, that's probably the most critical piece.

The rest of the script will really be depending on what you intend to do.

The only other documentation I can point you to is the generic custom listener page at adaptivist: https://scriptrunner.adaptavist.com/6.5.0-p5/jira/listeners.html#_custom_listeners

[Dylan Pokun]

Thank you very much @Peter-Dave Sheehan, that's very informative.

However, I noticed that I'm talking about ScriptRunner for Jira Cloud and you're talking about ScriptRunner for Jira Server.

As such, I can't find the same events and I can't even find the "Custom Listeners" tab. 

Should I give up?

Thanks again,

Regards,

Dylan

[Peter-Dave Sheehan]

My bad... I completely missed that you were working with Cloud.

Unfortunately, I know nothing of the capabilities and limitations of scriptrunner in a cloud environment. Especially with regards to listeners.

At a quick glance, there doesn't appear to be any login/logout event that can be used in a cloud listener. There is user_created, user_deleted and user_updated events only

[Dylan Pokun]

It's alright, I learned a lot thanks to you :-).

I'll do with what I have and suggest different behaviours to the client.

Thanks a lot for your time, I really appreciate it.

Regards,

Dylan

[Krzysztof]

@Peter-Dave Sheehan Were you able to get the username? to me returns null :/

[Peter-Dave Sheehan]

Hi @Krzysztof 

Not sure if you got from the thread that all my advice were only applicable to server/dc.

If you're on cloud, I can't help.

But for server, I have no issue accessing the user with:

def user = (event as LoginEvent).user //returns ApplicationUser

[Krzysztof]

Thanks! @Peter-Dave Sheehan 

---

import com.atlassian.jira.event.user.UserEvent

import com.onresolve.scriptrunner.runner.util.UserMessageUtil

def newUserEvent = event as UserEvent;

def appUser = newUserEvent.getUser();

int userEventType = newUserEvent.getEventType();

def message = "change your pass"

UserMessageUtil.info(message)

listner: LoginEvent, LoginFailedEvent and LogoutEvent

the above script shows the message only for the event: LogoutEvent

there is no error in the log - but the message does not appear both when logging in and when logging in incorrectly does anything else need to be added here?

[Peter-Dave Sheehan]

You can go review the javadocs for each of those events: LoginEvent, LogoutEvent, LoginFailedEvent

Or output some details to the log to see what's available in each class and build out a script that can show you those details.

E.g.

import com.atlassian.jira.event.user.LoginFailedEvent
import com.atlassian.jira.event.user.LoginEvent
import com.atlassian.jira.event.user.LogoutEvent

log.info event.metaClass*.methods.name.sort().unique()
log.info "event =$event"
log.info "event class=${event.getClass()}"
log.info "event.initiatingUser=$event.initiatingUser"
log.info "event.user=$event.user"
if(event instanceof LoginFailedEvent){
    log.info "event.loginInfo=$event.loginInfo"
    log.info "event.loginReason=$event.loginReason"
}

Whether the UserMessageUtil works in all cases or not, could be a matter of how that class is implemented. I think it's primarily designed for workflow feedback as it relies on certain client-side scripts being loaded and ready. 

I'm also unable to make it work on Login or LoginFailed events.