feat (jans-cedarling): Add CEDARLING_LOG_LEVEL bootstrap property (#1…

…0402) * feat(jans-cedarling): add bootstrap property `CEDARLING_LOG_LEVEL` Signed-off-by: Oleh Bohzok <[email protected]> * feat(jans-cedarling): add log level filtering Signed-off-by: Oleh Bohzok <[email protected]> * chore(jans-cedarling): add logging level to entry logs Signed-off-by: Oleh Bohzok <[email protected]> * chore(jans-cedarling): fix clippy issues Signed-off-by: Oleh Bohzok <[email protected]> * chore(jans-cedarling): remove logging log level if field is None Signed-off-by: Oleh Bohzok <[email protected]> * chore(jans-cedarling): update python config to log only info level logs and some user and workload claims Signed-off-by: Oleh Bohzok <[email protected]> * chore(jans-cedarling): fix bootstrap config serde name `CEDARLING_DECISION_LOG_USER_CLAIMS` Signed-off-by: Oleh Bohzok <[email protected]> * chore(jans-cedarling): update DecisionLogEntry, added macro to skip serialize some fields if empty Signed-off-by: Oleh Bohzok <[email protected]> * chore(jans-cedarling): add logging level for log message with cedar version Signed-off-by: Oleh Bohzok <[email protected]> * chore(jans-cedarling): change log message `configuration parsed successfully` to debug level Signed-off-by: Oleh Bohzok <[email protected]> * docs(jans-cedarling): update documentation Signed-off-by: Oleh Bohzok <[email protected]> * fix(jans-cedarling): fix error deserialize log level from python with error `invalid type: string "DEBUG", expected a borrowed string` Signed-off-by: Oleh Bohzok <[email protected]> --------- Signed-off-by: Oleh Bohzok <[email protected]>
JanssenProject · Dec 12, 2024 · 19296b7 · 19296b7
1 parent b6b45e1
commit 19296b7
Show file tree

Hide file tree

Showing 25 changed files with 230 additions and 47 deletions.
diff --git a/docs/cedarling/cedarling-logs.md b/docs/cedarling/cedarling-logs.md
@@ -30,7 +30,6 @@ There are three different log records produced by the Cedarling:
 * `System` - Startup, debug and other Cedarling messages not related to authz
 * `Metric`- Performance and usage data
 
-
 ### System Log Levels
 
 This is set by `CEDARLING_LOG_LEVEL`
@@ -57,22 +56,24 @@ The JSON in this document is formatted for readability but is not prettified in
 
 ```json
 {
-    "id": "01937015-462d-7727-b789-ed95f7faf7a4",
-    "time": 1732752262,
+    "request_id": "0193b8a8-efc0-77ce-bd90-4a62a2998462",
+    "timestamp": "2024-12-12T04:18:19.456Z",
     "log_kind": "System",
-    "pdp_id": "75f0dc93-0a90-4076-95fa-dc16d3f00375",
+    "pdp_id": "d47e245e-beaa-4ea4-b899-b8184cd3eb7e",
+    "level": "DEBUG",
     "msg": "configuration parsed successfully"
 }
 {
-    "id": "01937015-462f-7cb5-86bb-d06c56dc5ab3",
-    "time": 1732752262,
+    "request_id": "0193b8a8-efc1-7e42-9678-b2480268b91f",
+    "timestamp": "2024-12-12T04:18:19.457Z",
     "log_kind": "System",
-    "pdp_id": "75f0dc93-0a90-4076-95fa-dc16d3f00375",
+    "pdp_id": "d47e245e-beaa-4ea4-b899-b8184cd3eb7e",
+    "level": "INFO",
     "msg": "Cedarling Authz initialized successfully",
-    "application_id": "TestApp",
+    "application_id": "My App",
     "cedar_lang_version": "4.1.0",
     "cedar_sdk_version": "4.2.2"
-}      
+}
 ```
 
 ### Decision Log
@@ -138,7 +139,8 @@ The result of the authorization is quite extensive because we log all `cedar-pol
 {
     "id": "01937015-4649-7aad-8df8-4976e4bd8565",
     "time": 1732752262,
-    "log_kind": "Decision",
+    "log_type": "Decision",
+    "level": "DEBUG",
     "pdp_id": "75f0dc93-0a90-4076-95fa-dc16d3f00375",
     "msg": "Result of authorize.",
     "application_id": "TestApp",

diff --git a/docs/cedarling/cedarling-properties.md b/docs/cedarling/cedarling-properties.md
@@ -29,6 +29,13 @@ These Bootstrap Properties control default application level behavior.
 * **`CEDARLING_LOG_STORAGE`** : `off`, `memory`, `std_out`
 * **`CEDARLING_LOG_LEVEL`** : System Log Level [See here](./cedarling-logs.md). Default to `WARN`
 * **`CEDARLING_LOG_STDOUT_TYPE`** : Either `System`, `Metric`, or `Decision`. Default to System.
+* **`CEDARLING_LOG_LEVEL`** : Log level filter for logging. Log level has only `System` log type entries. `TRACE` is lowest. `FATAL` is highest. Possible variants:
+  * FATAL
+  * ERROR
+  * WARN
+  * INFO
+  * DEBUG
+  * TRACE
 * **`CEDARLING_DECISION_LOG_USER_CLAIMS`** : List of claims to map from user entity, such as ["sub", "email", "username", ...]
 * **`CEDARLING_DECISION_LOG_WORKLOAD_CLAIMS`** : List of claims to map from user entity, such as ["client_id", "rp_id", ...]
 * **`CEDARLING_DECISION_LOG_DEFAULT_JWT_ID`** : Token claims that will be used for decision logging. Default is "jti", but perhaps some other claim is needed.
@@ -134,6 +141,7 @@ Below is an example of a bootstrap config in JSON format. Not all fields should
     "CEDARLING_POLICY_STORE_URI": "",
     "CEDARLING_POLICY_STORE_ID": "840da5d85403f35ea76519ed1a18a33989f855bf1cf8",
     "CEDARLING_LOG_TYPE": "memory",
+    "CEDARLING_LOG_LEVEL": "INFO",
     "CEDARLING_DECISION_LOG_USER_CLAIMS": ["sub", "email", "username"],
     "CEDARLING_DECISION_LOG_WORKLOAD_CLAIMS": ["client_id", "rp_id"],
     "CEDARLING_DECISION_LOG_DEFAULT_JWT_ID": "jti",
@@ -207,6 +215,9 @@ CEDARLING_APPLICATION_NAME: My App
 CEDARLING_POLICY_STORE_URI: ''
 CEDARLING_POLICY_STORE_ID: '840da5d85403f35ea76519ed1a18a33989f855bf1cf8'
 CEDARLING_LOG_TYPE: 'memory'
+CEDARLING_LOG_LEVEL: 'INFO'
+CEDARLING_DECISION_LOG_USER_CLAIMS: ["sub","email"]
+CEDARLING_DECISION_LOG_WORKLOAD_CLAIMS: ["client_id", "rp_id"]
 CEDARLING_LOG_TTL: 60
 CEDARLING_USER_AUTHZ: 'enabled'
 CEDARLING_WORKLOAD_AUTHZ: 'enabled'

diff --git a/docs/cedarling/python/usage.md b/docs/cedarling/python/usage.md
@@ -19,9 +19,9 @@ In this example, we will show an example Python script that calls the `cedarling
 Policy store location not provided, use 'CEDARLING_LOCAL_POLICY_STORE' environment variable
 Used default policy store path: example_files/policy-store.json
 
-{"id":"0193414e-9672-786a-986c-57f48d41c4e4","time":1731967489,"log_kind":"System","pdp_id":"c0ec33ff-9482-4bdc-83f6-2925a41a3280","msg":"configuration parsed successfully"}
-{"id":"0193414e-9672-786a-986c-57f5379086c3","time":1731967489,"log_kind":"System","pdp_id":"c0ec33ff-9482-4bdc-83f6-2925a41a3280","msg":"Cedarling Authz initialized successfully","application_id":"TestApp"}
-{"id":"0193414e-9676-7d8a-b55b-3f0097355851","time":1731967489,"log_kind":"Decision","pdp_id":"c0ec33ff-9482-4bdc-83f6-2925a41a3280","msg":"Result of authorize.","application_id":"TestApp","action":"Jans::Action::\"Read\"","resource":"Jans::Application::\"some_id\"","context":{"user_agent":"Linux","operating_system":"Linux","network_type":"Local","network":"127.0.0.1","geolocation":["America"],"fraud_indicators":["Allowed"],"device_health":["Healthy"],"current_time":1731967489},"person_principal":"Jans::User::\"qzxn1Scrb9lWtGxVedMCky-Ql_ILspZaQA6fyuYktw0\"","person_diagnostics":{"reason":["840da5d85403f35ea76519ed1a18a33989f855bf1cf8"],"errors":[]},"person_decision":"ALLOW","workload_principal":"Jans::Workload::\"d7f71bea-c38d-4caf-a1ba-e43c74a11a62\"","workload_diagnostics":{"reason":["444da5d85403f35ea76519ed1a18a33989f855bf1cf8"],"errors":[]},"workload_decision":"ALLOW","authorized":true}
+{"id":"0193414e-9672-786a-986c-57f48d41c4e4","time":1731967489,"log_type":"System","pdp_id":"c0ec33ff-9482-4bdc-83f6-2925a41a3280","msg":"configuration parsed successfully"}
+{"id":"0193414e-9672-786a-986c-57f5379086c3","time":1731967489,"log_type":"System","pdp_id":"c0ec33ff-9482-4bdc-83f6-2925a41a3280","msg":"Cedarling Authz initialized successfully","application_id":"TestApp"}
+{"id":"0193414e-9676-7d8a-b55b-3f0097355851","time":1731967489,"log_type":"Decision","pdp_id":"c0ec33ff-9482-4bdc-83f6-2925a41a3280","msg":"Result of authorize.","application_id":"TestApp","action":"Jans::Action::\"Read\"","resource":"Jans::Application::\"some_id\"","context":{"user_agent":"Linux","operating_system":"Linux","network_type":"Local","network":"127.0.0.1","geolocation":["America"],"fraud_indicators":["Allowed"],"device_health":["Healthy"],"current_time":1731967489},"person_principal":"Jans::User::\"qzxn1Scrb9lWtGxVedMCky-Ql_ILspZaQA6fyuYktw0\"","person_diagnostics":{"reason":["840da5d85403f35ea76519ed1a18a33989f855bf1cf8"],"errors":[]},"person_decision":"ALLOW","workload_principal":"Jans::Workload::\"d7f71bea-c38d-4caf-a1ba-e43c74a11a62\"","workload_diagnostics":{"reason":["444da5d85403f35ea76519ed1a18a33989f855bf1cf8"],"errors":[]},"workload_decision":"ALLOW","authorized":true}
 Result of workload authorization: ALLOW
 Policy ID used:
 444da5d85403f35ea76519ed1a18a33989f855bf1cf8

diff --git a/jans-cedarling/bindings/cedarling_python/example_files/sample_bootstrap_props.yaml b/jans-cedarling/bindings/cedarling_python/example_files/sample_bootstrap_props.yaml
@@ -6,7 +6,10 @@ CEDARLING_APPLICATION_NAME: My App
 CEDARLING_POLICY_STORE_URI: null
 CEDARLING_POLICY_STORE_ID: gICAgcHJpbmNpcGFsIGlz
 CEDARLING_LOG_TYPE: std_out
+CEDARLING_LOG_LEVEL: INFO
 CEDARLING_LOG_TTL: null
+CEDARLING_DECISION_LOG_USER_CLAIMS: ["sub","email"]
+CEDARLING_DECISION_LOG_WORKLOAD_CLAIMS: ["client_id", "rp_id"]
 CEDARLING_USER_AUTHZ: enabled
 CEDARLING_WORKLOAD_AUTHZ: enabled
 CEDARLING_USER_WORKLOAD_BOOLEAN_OPERATION: AND

diff --git a/jans-cedarling/bindings/cedarling_python/src/config/bootstrap_config.rs b/jans-cedarling/bindings/cedarling_python/src/config/bootstrap_config.rs
@@ -47,8 +47,8 @@ pub struct BootstrapConfig {
 #[pymethods]
 impl BootstrapConfig {
     #[new]
-    pub fn new(options: &Bound<'_, PyDict>) -> PyResult<Self> {
-        let source: cedarling::BootstrapConfigRaw = serde_pyobject::from_pyobject(options.clone())
+    pub fn new(options: Bound<'_, PyDict>) -> PyResult<Self> {
+        let source: cedarling::BootstrapConfigRaw = serde_pyobject::from_pyobject(options)
             .map_err(|e| PyValueError::new_err(e.to_string()))?;
         let inner = cedarling::BootstrapConfig::from_raw_config(&source)
             .map_err(|e| PyValueError::new_err(e.to_string()))?;

diff --git a/jans-cedarling/bindings/cedarling_python/tests/config.py b/jans-cedarling/bindings/cedarling_python/tests/config.py
@@ -8,14 +8,16 @@
 # The human-readable policy and schema file is located in next folder:
 # `test_files\policy-store_ok`
 
+
 def load_bootstrap_config(policy_store_location=None, log_type="std_out", log_ttl=None):
     """
     Loads the bootstrap configuration with predefined settings.
     The policy store location can be optionally set.
     """
 
     if policy_store_location is None:
-        policy_store_location = os.path.join(TEST_FILES_PATH, "policy-store_ok.yaml")
+        policy_store_location = os.path.join(
+            TEST_FILES_PATH, "policy-store_ok.yaml")
 
     return BootstrapConfig({
         "CEDARLING_APPLICATION_NAME": "TestApp",
@@ -42,4 +44,5 @@ def load_bootstrap_config(policy_store_location=None, log_type="std_out", log_tt
         "CEDARLING_ID_TOKEN_TRUST_MODE": "none",
         "CEDARLING_LOG_TYPE": log_type,
         "CEDARLING_LOG_TTL": log_ttl,
+        "CEDARLING_LOG_LEVEL": "DEBUG",
     })
diff --git a/jans-cedarling/cedarling/examples/authorize_with_jwt_validation.rs b/jans-cedarling/cedarling/examples/authorize_with_jwt_validation.rs
@@ -7,7 +7,7 @@
 
 use cedarling::{
     AuthorizationConfig, BootstrapConfig, Cedarling, IdTokenTrustMode, JwtConfig, LogConfig,
-    LogTypeConfig, PolicyStoreConfig, PolicyStoreSource, Request, ResourceData,
+    LogLevel, LogTypeConfig, PolicyStoreConfig, PolicyStoreSource, Request, ResourceData,
     TokenValidationConfig, WorkloadBoolOp,
 };
 use jsonwebtoken::Algorithm;
@@ -43,6 +43,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
         application_name: "test_app".to_string(),
         log_config: LogConfig {
             log_type: LogTypeConfig::StdOut,
+            log_level: LogLevel::INFO,
         },
         policy_store_config: PolicyStoreConfig {
             source: PolicyStoreSource::Yaml(POLICY_STORE_RAW_YAML.to_string()),

diff --git a/jans-cedarling/cedarling/examples/authorize_without_jwt_validation.rs b/jans-cedarling/cedarling/examples/authorize_without_jwt_validation.rs
@@ -6,7 +6,7 @@
  */
 
 use cedarling::{
-    AuthorizationConfig, BootstrapConfig, Cedarling, JwtConfig, LogConfig, LogTypeConfig,
+    AuthorizationConfig, BootstrapConfig, Cedarling, JwtConfig, LogConfig, LogLevel, LogTypeConfig,
     PolicyStoreConfig, PolicyStoreSource, Request, ResourceData, WorkloadBoolOp,
 };
 use std::collections::HashMap;
@@ -18,6 +18,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
         application_name: "test_app".to_string(),
         log_config: LogConfig {
             log_type: LogTypeConfig::StdOut,
+            log_level: LogLevel::INFO,
         },
         policy_store_config: PolicyStoreConfig {
             source: PolicyStoreSource::Yaml(POLICY_STORE_RAW.to_string()),

diff --git a/jans-cedarling/cedarling/examples/log_init.rs b/jans-cedarling/cedarling/examples/log_init.rs
@@ -12,7 +12,7 @@
 #![cfg(not(target_family = "wasm"))]
 
 use cedarling::{
-    AuthorizationConfig, BootstrapConfig, Cedarling, JwtConfig, LogConfig, LogStorage,
+    AuthorizationConfig, BootstrapConfig, Cedarling, JwtConfig, LogConfig, LogLevel, LogStorage,
     LogTypeConfig, MemoryLogConfig, PolicyStoreConfig, PolicyStoreSource, WorkloadBoolOp,
 };
 use std::env;
@@ -48,7 +48,10 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
     println!("Cedarling initialized with log type: {:?}", log_type);
     let cedarling = Cedarling::new(&BootstrapConfig {
         application_name: "test_app".to_string(),
-        log_config: LogConfig { log_type },
+        log_config: LogConfig {
+            log_type,
+            log_level: LogLevel::INFO,
+        },
         policy_store_config: PolicyStoreConfig {
             source: PolicyStoreSource::Yaml(POLICY_STORE_RAW.to_string()),
         },

diff --git a/jans-cedarling/cedarling/src/authz/mod.rs b/jans-cedarling/cedarling/src/authz/mod.rs
@@ -16,7 +16,7 @@ use std::sync::Arc;
 use crate::bootstrap_config::AuthorizationConfig;
 use crate::common::app_types;
 use crate::common::policy_store::PolicyStoreWithID;
-use crate::jwt;
+use crate::{jwt, LogLevel};
 use crate::log::interface::LogWriter;
 use crate::log::{
     AuthorizationLogInfo, BaseLogEntry, DecisionLogEntry, Diagnostics, LogEntry, LogTokensInfo, LogType, Logger, PersonAuthorizeInfo, PrincipalLogEntry, WorkloadAuthorizeInfo
@@ -72,7 +72,7 @@ impl Authz {
                 Some(config.application_name.clone()),
                 LogType::System,
             )
-            .set_cedar_version()
+            .set_cedar_version().set_level(LogLevel::INFO)
             .set_message("Cedarling Authz initialized successfully".to_string()),
         );
 
@@ -187,8 +187,8 @@ impl Authz {
             LogEntry::new_with_data(
                 self.config.pdp_id,
                 Some(self.config.application_name.clone()),
-                LogType::Decision,
-            )
+                LogType::System,
+            ).set_level(LogLevel::DEBUG)
             .set_auth_info(AuthorizationLogInfo {
                 action: request.action.clone(),
                 context: request.context.clone(),
@@ -448,12 +448,12 @@ pub struct CreateRequestRoleError {
 /// Get entity claims from list in config
 // 
 // To get claims we convert entity to json, because no other way to get introspection
-fn get_entity_claims(decision_log_claims: &[String], entities: &Entities,principal_user_entity_uid: EntityUid) -> HashMap<String, serde_json::Value> {
+fn get_entity_claims(decision_log_claims: &[String], entities: &Entities, entity_uid: EntityUid) -> HashMap<String, serde_json::Value> {
     HashMap::from_iter(  decision_log_claims
         .iter()
         .filter_map(|claim_key| {
             entities
-                .get(&principal_user_entity_uid)
+                .get(&entity_uid)
                 // convert entity to json and result to option
                 .and_then(|entity| entity.to_json_value().ok())
                 // JSON structure of entity:

diff --git a/jans-cedarling/cedarling/src/bootstrap_config/decode.rs b/jans-cedarling/cedarling/src/bootstrap_config/decode.rs
@@ -10,6 +10,7 @@ use super::{
     IdTokenTrustMode, JwtConfig, LogConfig, LogTypeConfig, MemoryLogConfig, PolicyStoreConfig,
     PolicyStoreSource, TokenValidationConfig,
 };
+use crate::log::LogLevel;
 use jsonwebtoken::Algorithm;
 use serde::{Deserialize, Deserializer, Serialize};
 use std::{collections::HashSet, fmt::Display, fs, path::Path, str::FromStr};
@@ -38,8 +39,17 @@ pub struct BootstrapConfigRaw {
     #[serde(rename = "CEDARLING_LOG_TYPE", default)]
     pub log_type: LoggerType,
 
+    /// Log level filter for logging. TRACE is lowest. FATAL is highest.
+    #[serde(rename = "CEDARLING_LOG_LEVEL", default)]
+    pub log_level: LogLevel,
+
+    /// If `log_type` is set to [`LogType::Memory`], this is the TTL (time to live) of
+    /// log entities in seconds.
+    #[serde(rename = "CEDARLING_LOG_TTL", default)]
+    pub log_ttl: Option<u64>,
+
     /// List of claims to map from user entity, such as ["sub", "email", "username", ...]
-    #[serde(rename = "CEDARLING_DECISION_LOG_USER_CLAIMS ", default)]
+    #[serde(rename = "CEDARLING_DECISION_LOG_USER_CLAIMS", default)]
     pub decision_log_user_claims: Vec<String>,
 
     /// List of claims to map from user entity, such as ["client_id", "rp_id", ...]
@@ -51,11 +61,6 @@ pub struct BootstrapConfigRaw {
     #[serde(rename = "CEDARLING_DECISION_LOG_DEFAULT_JWT_ID", default)]
     pub decision_log_default_jwt_id: String,
 
-    /// If `log_type` is set to [`LogType::Memory`], this is the TTL (time to live) of
-    /// log entities in seconds.
-    #[serde(rename = "CEDARLING_LOG_TTL", default)]
-    pub log_ttl: Option<u64>,
-
     /// When `enabled`, Cedar engine authorization is queried for a User principal.
     #[serde(rename = "CEDARLING_USER_AUTHZ", default)]
     pub user_authz: FeatureToggle,
@@ -433,7 +438,10 @@ impl BootstrapConfig {
             LoggerType::StdOut => LogTypeConfig::StdOut,
             LoggerType::Lock => LogTypeConfig::Lock,
         };
-        let log_config = LogConfig { log_type };
+        let log_config = LogConfig {
+            log_type,
+            log_level: raw.log_level,
+        };
 
         // Decode policy store
         let policy_store_config = match (

diff --git a/jans-cedarling/cedarling/src/bootstrap_config/log_config.rs b/jans-cedarling/cedarling/src/bootstrap_config/log_config.rs
@@ -5,11 +5,17 @@
  * Copyright (c) 2024, Gluu, Inc.
  */
 
+use crate::log::LogLevel;
+
 /// A set of properties used to configure logging in the `Cedarling` application.
 #[derive(Debug, Clone, PartialEq)]
 pub struct LogConfig {
     /// `CEDARLING_LOG_TYPE` in [bootstrap properties](https://github.com/JanssenProject/jans/wiki/Cedarling-Nativity-Plan#bootstrap-properties) documentation.
     pub log_type: LogTypeConfig,
+
+    /// Log level filter for logging. TRACE is lowest. FATAL is highest.
+    /// `CEDARLING_LOG_LEVEL` in [bootstrap properties](https://github.com/JanssenProject/jans/wiki/Cedarling-Nativity-Plan#bootstrap-properties) documentation.
+    pub log_level: LogLevel,
 }
 
 ///  Log type configuration.

diff --git a/jans-cedarling/cedarling/src/bootstrap_config/mod.rs b/jans-cedarling/cedarling/src/bootstrap_config/mod.rs
@@ -157,6 +157,7 @@ mod test {
             application_name: "My App".to_string(),
             log_config: LogConfig {
                 log_type: LogTypeConfig::StdOut,
+                log_level: crate::LogLevel::DEBUG,
             },
             policy_store_config: PolicyStoreConfig {
                 source: crate::PolicyStoreSource::FileJson(
@@ -211,6 +212,7 @@ mod test {
             application_name: "My App".to_string(),
             log_config: LogConfig {
                 log_type: LogTypeConfig::Memory(MemoryLogConfig { log_ttl: 60 }),
+                log_level: crate::LogLevel::DEBUG,
             },
             policy_store_config: PolicyStoreConfig {
                 source: crate::PolicyStoreSource::FileJson(

diff --git a/jans-cedarling/cedarling/src/lib.rs b/jans-cedarling/cedarling/src/lib.rs
@@ -39,8 +39,8 @@ use init::ServiceFactory;
 use common::app_types;
 use log::interface::LogWriter;
 use log::LogEntry;
-pub use log::LogStorage;
 use log::LogType;
+pub use log::{LogLevel, LogStorage};
 
 pub use crate::authz::entities::CedarPolicyCreateTypeError;
 
@@ -85,13 +85,15 @@ impl Cedarling {
             .inspect(|_| {
                 log.log(
                     LogEntry::new_with_data(pdp_id, None, LogType::System)
+                        .set_level(LogLevel::DEBUG)
                         .set_message("configuration parsed successfully".to_string()),
                 )
             })
             .inspect_err(|err| {
                 log.log(
                     LogEntry::new_with_data(pdp_id, None, LogType::System)
                         .set_error(err.to_string())
+                        .set_level(LogLevel::ERROR)
                         .set_message("configuration parsed with error".to_string()),
                 )
             })?;

diff --git a/jans-cedarling/cedarling/src/log/interface.rs b/jans-cedarling/cedarling/src/log/interface.rs
@@ -9,6 +9,7 @@
 //! Contains the interface for logging. And getting log information from storage.
 
 use super::LogEntry;
+use super::LogLevel;
 use uuid7::Uuid;
 
 /// Log Writer
@@ -24,7 +25,31 @@ pub(crate) trait LogWriter {
 }
 
 pub(crate) trait Loggable: serde::Serialize {
+    /// get unique request ID
     fn get_request_id(&self) -> Uuid;
+    /// get log level for entity
+    /// not all log entities have log level, only when `log_kind` == `System`
+    fn get_log_level(&self) -> Option<LogLevel>;
+
+    /// check if entry can log to logger
+    ///
+    // default implementation of method
+    // is used to avoid boilerplate code
+    fn can_log(&self, logger_level: LogLevel) -> bool {
+        if let Some(entry_log_level) = self.get_log_level() {
+            if entry_log_level < logger_level {
+                // entry log level lower than logger level
+                false
+            } else {
+                // entry log higher or equal than logger level
+                true
+            }
+        } else {
+            // if `.get_log_level` return None
+            // it means that `log_kind` != `System` and we should log it
+            true
+        }
+    }
 }
 
 /// Log Storage