Move log and settings into security module

Move the `SecurityLog` and `SecuritySettings` into separate sub-packages
of the enterprise security module.

community/security/src/main/java/org/neo4j/server/security/auth/AuthProcedures.java

@@ -51,7 +51,6 @@ public void createUser(
             throws InvalidArgumentsException, IOException
     {
         BasicAuthSubject subject = BasicAuthSubject.castOrFail( authSubject );
-//        subject.getAuthManager().newUser( username, password, requirePasswordChange );
         userManager.newUser( username, password, requirePasswordChange );
     }
 

enterprise/kernel/src/main/java/org/neo4j/kernel/impl/enterprise/configuration/EnterpriseEditionSettings.java

@@ -19,25 +19,15 @@
  */
 package org.neo4j.kernel.impl.enterprise.configuration;
 
-import java.io.File;
 import java.util.List;
 
 import org.neo4j.graphdb.config.Setting;
 import org.neo4j.graphdb.factory.Description;
-import org.neo4j.graphdb.factory.GraphDatabaseSettings;
 import org.neo4j.kernel.configuration.Internal;
 import org.neo4j.kernel.impl.store.id.IdType;
 
-import static org.neo4j.kernel.configuration.Settings.BOOLEAN;
-import static org.neo4j.kernel.configuration.Settings.BYTES;
-import static org.neo4j.kernel.configuration.Settings.DURATION;
-import static org.neo4j.kernel.configuration.Settings.INTEGER;
-import static org.neo4j.kernel.configuration.Settings.PATH;
 import static org.neo4j.kernel.configuration.Settings.STRING;
-import static org.neo4j.kernel.configuration.Settings.derivedSetting;
 import static org.neo4j.kernel.configuration.Settings.list;
-import static org.neo4j.kernel.configuration.Settings.max;
-import static org.neo4j.kernel.configuration.Settings.min;
 import static org.neo4j.kernel.configuration.Settings.optionsIgnoreCase;
 import static org.neo4j.kernel.configuration.Settings.setting;
 import static org.neo4j.kernel.impl.store.id.IdType.NODE;
@@ -56,28 +46,6 @@ public class EnterpriseEditionSettings
             "dbms.ids.reuse.types.override", list( ",", optionsIgnoreCase( NODE, RELATIONSHIP ) ),
             String.join( ",", IdType.RELATIONSHIP.name(), IdType.NODE.name() ) );
 
-    @Internal
-    public static final Setting<File> security_log_filename = derivedSetting("dbms.security.log_path",
-            GraphDatabaseSettings.logs_directory,
-            ( logs ) -> new File( logs, "security.log" ),
-            PATH );
-
-    @Description( "Set to log successful authentication events." )
-    public static final Setting<Boolean> security_log_successful_authentication =
-            setting("dbms.security.log_successful_authentication", BOOLEAN, "true" );
-
-    @Description( "Threshold for rotation of the security log." )
-    public static final Setting<Long> store_security_log_rotation_threshold =
-            setting("dbms.logs.security.rotation.size", BYTES, "20m", min(0L), max( Long.MAX_VALUE ) );
-
-    @Description( "Minimum time interval after last rotation of the security log before it may be rotated again." )
-    public static final Setting<Long> store_security_log_rotation_delay =
-            setting("dbms.logs.security.rotation.delay", DURATION, "300s" );
-
-    @Description( "Maximum number of history files for the security log." )
-    public static final Setting<Integer> store_security_log_max_archives =
-            setting("dbms.logs.security.rotation.keep_number", INTEGER, "7", min(1) );
-
     @Internal
     public static final Setting<String> security_module = setting( "unsupported.dbms.security.module", STRING,
             ENTERPRISE_SECURITY_MODULE_ID );

enterprise/security/src/main/java/org/neo4j/server/security/enterprise/auth/AuthProcedures.java

@@ -35,7 +35,7 @@
 import org.neo4j.kernel.api.exceptions.InvalidArgumentsException;
 import org.neo4j.kernel.impl.api.KernelTransactions;
 import org.neo4j.kernel.impl.core.ThreadToStatementContextBridge;
-import org.neo4j.kernel.impl.enterprise.SecurityLog;
+import org.neo4j.server.security.enterprise.log.SecurityLog;
 import org.neo4j.kernel.internal.GraphDatabaseAPI;
 import org.neo4j.procedure.Context;
 import org.neo4j.procedure.Description;

enterprise/security/src/main/java/org/neo4j/server/security/enterprise/auth/EnterpriseSecurityModule.java

@@ -35,9 +35,9 @@
 import org.neo4j.kernel.api.exceptions.KernelException;
 import org.neo4j.kernel.api.security.SecurityModule;
 import org.neo4j.kernel.configuration.Config;
-import org.neo4j.kernel.enterprise.api.security.EnterpriseAuthManager;
-import org.neo4j.kernel.impl.enterprise.SecurityLog;
 import org.neo4j.kernel.impl.enterprise.configuration.EnterpriseEditionSettings;
+import org.neo4j.server.security.enterprise.configuration.SecuritySettings;
+import org.neo4j.server.security.enterprise.log.SecurityLog;
 import org.neo4j.kernel.impl.factory.GraphDatabaseFacade;
 import org.neo4j.kernel.impl.factory.PlatformModule;
 import org.neo4j.kernel.impl.proc.Procedures;
@@ -128,7 +128,7 @@ public EnterpriseAuthAndUserManager newAuthManager( Config config, LogProvider l
         }
 
         return new MultiRealmAuthManager( internalRealm, orderedActiveRealms, createCacheManager( config ),
-                securityLog, config.get( EnterpriseEditionSettings.security_log_successful_authentication ) );
+                securityLog, config.get( SecuritySettings.security_log_successful_authentication ) );
     }
 
     private static List<Realm> selectOrderedActiveRealms( List<String> configuredRealms, List<Realm> availableRealms )

enterprise/security/src/main/java/org/neo4j/server/security/enterprise/auth/InternalFlatFileRealm.java

@@ -58,6 +58,7 @@
 import org.neo4j.server.security.enterprise.auth.plugin.api.PredefinedRoles;
 import org.neo4j.server.security.enterprise.auth.plugin.api.RealmOperations;
 import org.neo4j.server.security.enterprise.auth.plugin.spi.RealmLifecycle;
+import org.neo4j.server.security.enterprise.configuration.SecuritySettings;
 
 import static java.lang.String.format;
 

enterprise/security/src/main/java/org/neo4j/server/security/enterprise/auth/LdapRealm.java

@@ -62,7 +62,8 @@
 import org.neo4j.kernel.api.security.AuthenticationResult;
 import org.neo4j.kernel.api.security.exception.InvalidAuthTokenException;
 import org.neo4j.kernel.configuration.Config;
-import org.neo4j.kernel.impl.enterprise.SecurityLog;
+import org.neo4j.server.security.enterprise.configuration.SecuritySettings;
+import org.neo4j.server.security.enterprise.log.SecurityLog;
 
 import static java.lang.String.format;
 import org.neo4j.server.security.auth.Credential;

enterprise/security/src/main/java/org/neo4j/server/security/enterprise/auth/MultiRealmAuthManager.java

@@ -45,7 +45,7 @@
 import org.neo4j.kernel.api.security.AuthenticationResult;
 import org.neo4j.kernel.api.security.exception.InvalidAuthTokenException;
 import org.neo4j.kernel.enterprise.api.security.EnterpriseAuthSubject;
-import org.neo4j.kernel.impl.enterprise.SecurityLog;
+import org.neo4j.server.security.enterprise.log.SecurityLog;
 import org.neo4j.server.security.enterprise.auth.plugin.spi.RealmLifecycle;
 
 import static org.neo4j.helpers.Strings.escape;

enterprise/security/src/main/java/org/neo4j/server/security/enterprise/auth/StandardEnterpriseAuthSubject.java

@@ -28,7 +28,7 @@
 import org.neo4j.kernel.api.security.AuthenticationResult;
 import org.neo4j.kernel.api.exceptions.InvalidArgumentsException;
 import org.neo4j.kernel.enterprise.api.security.EnterpriseAuthSubject;
-import org.neo4j.kernel.impl.enterprise.SecurityLog;
+import org.neo4j.server.security.enterprise.log.SecurityLog;
 
 public class StandardEnterpriseAuthSubject implements EnterpriseAuthSubject
 {

enterprise/security/src/main/java/org/neo4j/server/security/enterprise/auth/plugin/PluginRealm.java

@@ -53,7 +53,7 @@
 import org.neo4j.server.security.enterprise.auth.plugin.spi.CustomCacheableAuthenticationInfo;
 import org.neo4j.server.security.enterprise.auth.plugin.spi.RealmLifecycle;
 
-import static org.neo4j.server.security.enterprise.auth.SecuritySettings.PLUGIN_REALM_NAME_PREFIX;
+import static org.neo4j.server.security.enterprise.configuration.SecuritySettings.PLUGIN_REALM_NAME_PREFIX;
 
 public class PluginRealm extends AuthorizingRealm implements RealmLifecycle
 {

enterprise/security/src/main/java/org/neo4j/server/security/enterprise/auth/SecuritySettings.java → enterprise/security/src/main/java/org/neo4j/server/security/enterprise/configuration/SecuritySettings.java

@@ -17,22 +17,28 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  */
-package org.neo4j.server.security.enterprise.auth;
+package org.neo4j.server.security.enterprise.configuration;
 
+import java.io.File;
 import java.util.Arrays;
 import java.util.List;
 
 import org.neo4j.graphdb.config.Setting;
 import org.neo4j.graphdb.factory.Description;
+import org.neo4j.graphdb.factory.GraphDatabaseSettings;
 import org.neo4j.kernel.configuration.Internal;
 
 import static org.neo4j.kernel.configuration.Settings.BOOLEAN;
+import static org.neo4j.kernel.configuration.Settings.BYTES;
 import static org.neo4j.kernel.configuration.Settings.DURATION;
 import static org.neo4j.kernel.configuration.Settings.INTEGER;
 import static org.neo4j.kernel.configuration.Settings.NO_DEFAULT;
+import static org.neo4j.kernel.configuration.Settings.PATH;
 import static org.neo4j.kernel.configuration.Settings.STRING;
 import static org.neo4j.kernel.configuration.Settings.STRING_LIST;
 import static org.neo4j.kernel.configuration.Settings.derivedSetting;
+import static org.neo4j.kernel.configuration.Settings.max;
+import static org.neo4j.kernel.configuration.Settings.min;
 import static org.neo4j.kernel.configuration.Settings.setting;
 
 /**
@@ -47,6 +53,10 @@ public class SecuritySettings
 
     @SuppressWarnings( "unused" ) // accessed by reflection
 
+    //=========================================================================
+    // Realm settings
+    //=========================================================================
+
     @Description( "The security realm that contains the users and roles used for authentication and authorization. " +
                   "This can be one of the built-in `" + NATIVE_REALM_NAME + "` or `" + LDAP_REALM_NAME + "` realms, " +
                   "or it can be an externally provided plugin realm, with a custom name prefixed by `" +
@@ -99,6 +109,10 @@ public class SecuritySettings
                     ( realms ) -> realms.stream().anyMatch( ( r ) -> r.startsWith( PLUGIN_REALM_NAME_PREFIX ) ),
                     BOOLEAN );
 
+    //=========================================================================
+    // LDAP settings
+    //=========================================================================
+
     @Description( "URL of LDAP server (with protocol, hostname and port) to use for authentication and authorization. " +
                   "If no protocol is specified the default will be `ldap://`. To use LDAPS, " +
                   "set the protocol and port, e.g. `ldaps://ldap.example.com:636`" )
@@ -189,6 +203,10 @@ public class SecuritySettings
     public static Setting<String> ldap_authorization_group_to_role_mapping =
             setting( "dbms.security.realms.ldap.authorization.group_to_role_mapping", STRING, NO_DEFAULT );
 
+    //=========================================================================
+    // Cache settings
+    //=========================================================================
+
     @Description( "The time to live (TTL) for cached authentication and authorization info. Setting the TTL to 0 will" +
             " disable auth caching." )
     public static Setting<Long> auth_cache_ttl =
@@ -197,4 +215,30 @@ public class SecuritySettings
     @Description( "The maximum capacity for authentication and authorization caches (respectively)." )
     public static Setting<Integer> auth_cache_max_capacity =
             setting( "dbms.security.realms.auth_cache_max_capacity", INTEGER, "10000" );
+
+    //=========================================================================
+    // Security log settings
+    //=========================================================================
+
+    @Internal
+    public static final Setting<File> security_log_filename = derivedSetting("dbms.security.log_path",
+            GraphDatabaseSettings.logs_directory,
+            ( logs ) -> new File( logs, "security.log" ),
+            PATH );
+
+    @Description( "Set to log successful authentication events." )
+    public static final Setting<Boolean> security_log_successful_authentication =
+            setting("dbms.security.log_successful_authentication", BOOLEAN, "true" );
+
+    @Description( "Threshold for rotation of the security log." )
+    public static final Setting<Long> store_security_log_rotation_threshold =
+            setting("dbms.logs.security.rotation.size", BYTES, "20m", min(0L), max( Long.MAX_VALUE ) );
+
+    @Description( "Minimum time interval after last rotation of the security log before it may be rotated again." )
+    public static final Setting<Long> store_security_log_rotation_delay =
+            setting("dbms.logs.security.rotation.delay", DURATION, "300s" );
+
+    @Description( "Maximum number of history files for the security log." )
+    public static final Setting<Integer> store_security_log_max_archives =
+            setting("dbms.logs.security.rotation.keep_number", INTEGER, "7", min(1) );
 }

enterprise/kernel/src/main/java/org/neo4j/kernel/impl/enterprise/SecurityLog.java → enterprise/security/src/main/java/org/neo4j/server/security/enterprise/log/SecurityLog.java

@@ -17,7 +17,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  */
-package org.neo4j.kernel.impl.enterprise;
+package org.neo4j.server.security.enterprise.log;
 
 import java.io.File;
 import java.io.IOException;
@@ -27,17 +27,16 @@
 import org.neo4j.io.fs.FileSystemAbstraction;
 import org.neo4j.kernel.api.security.AuthSubject;
 import org.neo4j.kernel.configuration.Config;
-import org.neo4j.kernel.impl.enterprise.configuration.EnterpriseEditionSettings;
 import org.neo4j.kernel.impl.util.JobScheduler;
 import org.neo4j.kernel.lifecycle.LifecycleAdapter;
 import org.neo4j.logging.FormattedLog;
 import org.neo4j.logging.Log;
 import org.neo4j.logging.Logger;
 import org.neo4j.logging.RotatingFileOutputStreamSupplier;
 import org.neo4j.logging.async.AsyncLog;
+import org.neo4j.server.security.enterprise.configuration.SecuritySettings;
 
 import static org.neo4j.helpers.Strings.escape;
-import static org.neo4j.kernel.impl.enterprise.configuration.EnterpriseEditionSettings.security_log_filename;
 
 public class SecurityLog extends LifecycleAdapter implements Log
 {
@@ -47,12 +46,12 @@ public class SecurityLog extends LifecycleAdapter implements Log
     public SecurityLog( Config config, FileSystemAbstraction fileSystem, Executor executor ) throws IOException
     {
         FormattedLog.Builder builder = FormattedLog.withUTCTimeZone();
-        File logFile = config.get( security_log_filename );
+        File logFile = config.get( SecuritySettings.security_log_filename );
 
         rotatingSupplier = new RotatingFileOutputStreamSupplier( fileSystem, logFile,
-                config.get( EnterpriseEditionSettings.store_security_log_rotation_threshold ),
-                config.get( EnterpriseEditionSettings.store_security_log_rotation_delay ),
-                config.get( EnterpriseEditionSettings.store_security_log_max_archives ), executor );
+                config.get( SecuritySettings.store_security_log_rotation_threshold ),
+                config.get( SecuritySettings.store_security_log_rotation_delay ),
+                config.get( SecuritySettings.store_security_log_max_archives ), executor );
 
         this.inner = new AsyncLog(
                 event -> executor.execute( event::process ),

enterprise/security/src/test/java/org/neo4j/server/security/enterprise/auth/AuthProceduresLoggingTest.java

@@ -29,7 +29,7 @@
 import org.neo4j.graphdb.security.AuthorizationViolationException;
 import org.neo4j.kernel.api.exceptions.InvalidArgumentsException;
 import org.neo4j.kernel.api.security.AuthSubject;
-import org.neo4j.kernel.impl.enterprise.SecurityLog;
+import org.neo4j.server.security.enterprise.log.SecurityLog;
 import org.neo4j.kernel.impl.util.JobScheduler;
 import org.neo4j.kernel.internal.GraphDatabaseAPI;
 import org.neo4j.logging.AssertableLogProvider;

enterprise/security/src/test/java/org/neo4j/server/security/enterprise/auth/EnterpriseSecurityModuleTest.java

@@ -26,7 +26,8 @@
 import java.util.Arrays;
 
 import org.neo4j.kernel.configuration.Config;
-import org.neo4j.kernel.impl.enterprise.SecurityLog;
+import org.neo4j.server.security.enterprise.configuration.SecuritySettings;
+import org.neo4j.server.security.enterprise.log.SecurityLog;
 import org.neo4j.logging.Log;
 import org.neo4j.logging.LogProvider;
 

enterprise/security/src/test/java/org/neo4j/server/security/enterprise/auth/InternalFlatFileRealmTest.java

@@ -36,7 +36,7 @@
 import org.neo4j.kernel.api.security.AuthenticationResult;
 import org.neo4j.kernel.api.security.exception.InvalidAuthTokenException;
 import org.neo4j.kernel.enterprise.api.security.EnterpriseAuthSubject;
-import org.neo4j.kernel.impl.enterprise.SecurityLog;
+import org.neo4j.server.security.enterprise.log.SecurityLog;
 import org.neo4j.kernel.impl.util.JobScheduler;
 import org.neo4j.server.security.auth.AuthenticationStrategy;
 import org.neo4j.server.security.auth.BasicPasswordPolicy;

enterprise/security/src/test/java/org/neo4j/server/security/enterprise/auth/LdapCachingTest.java

@@ -41,7 +41,8 @@
 import org.neo4j.kernel.api.security.exception.InvalidAuthTokenException;
 import org.neo4j.kernel.configuration.Config;
 import org.neo4j.kernel.enterprise.api.security.EnterpriseAuthSubject;
-import org.neo4j.kernel.impl.enterprise.SecurityLog;
+import org.neo4j.server.security.enterprise.configuration.SecuritySettings;
+import org.neo4j.server.security.enterprise.log.SecurityLog;
 import org.neo4j.kernel.impl.util.JobScheduler;
 import org.neo4j.server.security.auth.BasicPasswordPolicy;
 import org.neo4j.server.security.auth.InMemoryUserRepository;

enterprise/security/src/test/java/org/neo4j/server/security/enterprise/auth/LdapRealmTest.java

@@ -48,7 +48,8 @@
 import javax.naming.ldap.LdapContext;
 
 import org.neo4j.kernel.configuration.Config;
-import org.neo4j.kernel.impl.enterprise.SecurityLog;
+import org.neo4j.server.security.enterprise.configuration.SecuritySettings;
+import org.neo4j.server.security.enterprise.log.SecurityLog;
 
 import static java.util.Arrays.asList;
 import static java.util.Collections.singletonList;

enterprise/security/src/test/java/org/neo4j/server/security/enterprise/auth/MultiRealmAuthManagerRule.java

@@ -28,7 +28,7 @@
 import java.util.Collections;
 
 import org.neo4j.kernel.api.security.AuthSubject;
-import org.neo4j.kernel.impl.enterprise.SecurityLog;
+import org.neo4j.server.security.enterprise.log.SecurityLog;
 import org.neo4j.kernel.impl.util.JobScheduler;
 import org.neo4j.logging.AssertableLogProvider;
 import org.neo4j.logging.Log;

enterprise/security/src/test/java/org/neo4j/server/security/enterprise/auth/MultiRealmAuthManagerTest.java

@@ -33,7 +33,7 @@
 import org.neo4j.kernel.api.security.AuthenticationResult;
 import org.neo4j.kernel.api.security.exception.InvalidAuthTokenException;
 import org.neo4j.kernel.configuration.Config;
-import org.neo4j.kernel.impl.enterprise.SecurityLog;
+import org.neo4j.server.security.enterprise.log.SecurityLog;
 import org.neo4j.kernel.impl.util.JobScheduler;
 import org.neo4j.logging.AssertableLogProvider;
 import org.neo4j.logging.Log;

enterprise/security/src/test/java/org/neo4j/server/security/enterprise/auth/integration/bolt/ActiveDirectoryAuthenticationIT.java

@@ -39,7 +39,7 @@
 import org.neo4j.graphdb.factory.GraphDatabaseSettings;
 import org.neo4j.helpers.HostnamePort;
 import org.neo4j.kernel.api.exceptions.Status;
-import org.neo4j.server.security.enterprise.auth.SecuritySettings;
+import org.neo4j.server.security.enterprise.configuration.SecuritySettings;
 import org.neo4j.test.TestEnterpriseGraphDatabaseFactory;
 import org.neo4j.test.TestGraphDatabaseFactory;
 

enterprise/security/src/test/java/org/neo4j/server/security/enterprise/auth/integration/bolt/EnterpriseAuthenticationTestBase.java

@@ -38,7 +38,7 @@
 import org.neo4j.graphdb.factory.GraphDatabaseSettings;
 import org.neo4j.helpers.HostnamePort;
 import org.neo4j.kernel.api.exceptions.Status;
-import org.neo4j.server.security.enterprise.auth.SecuritySettings;
+import org.neo4j.server.security.enterprise.configuration.SecuritySettings;
 import org.neo4j.test.TestEnterpriseGraphDatabaseFactory;
 import org.neo4j.test.TestGraphDatabaseFactory;
 

enterprise/security/src/test/java/org/neo4j/server/security/enterprise/auth/integration/bolt/LdapAuthenticationIT.java

@@ -50,7 +50,7 @@
 import org.neo4j.kernel.impl.proc.Procedures;
 import org.neo4j.kernel.internal.GraphDatabaseAPI;
 import org.neo4j.server.security.enterprise.auth.ProcedureInteractionTestBase;
-import org.neo4j.server.security.enterprise.auth.SecuritySettings;
+import org.neo4j.server.security.enterprise.configuration.SecuritySettings;
 
 import static org.hamcrest.CoreMatchers.equalTo;
 import static org.hamcrest.MatcherAssert.assertThat;

enterprise/security/src/test/java/org/neo4j/server/security/enterprise/auth/integration/bolt/LdapExamplePluginAuthenticationIT.java

@@ -37,7 +37,7 @@
 import java.util.function.Consumer;
 
 import org.neo4j.graphdb.config.Setting;
-import org.neo4j.server.security.enterprise.auth.SecuritySettings;
+import org.neo4j.server.security.enterprise.configuration.SecuritySettings;
 import org.neo4j.server.security.enterprise.auth.plugin.LdapGroupHasUsersAuthPlugin;
 
 @RunWith( FrameworkRunner.class )

enterprise/security/src/test/java/org/neo4j/server/security/enterprise/auth/integration/bolt/PluginAuthenticationIT.java

@@ -31,7 +31,7 @@
 import org.neo4j.bolt.v1.transport.integration.TransportTestUtil;
 import org.neo4j.graphdb.config.Setting;
 import org.neo4j.kernel.api.exceptions.Status;
-import org.neo4j.server.security.enterprise.auth.SecuritySettings;
+import org.neo4j.server.security.enterprise.configuration.SecuritySettings;
 import org.neo4j.server.security.enterprise.auth.plugin.TestCacheableAuthPlugin;
 import org.neo4j.server.security.enterprise.auth.plugin.TestCacheableAuthenticationPlugin;
 import org.neo4j.server.security.enterprise.auth.plugin.TestCustomCacheableAuthenticationPlugin;