[JIRA] Resolved: (SSPCPP-349) Parseable audit logs for SP

[Scott Cantor (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/SSPCPP-349?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Scott Cantor resolved SSPCPP-349.
---------------------------------

    Resolution: Fixed

http://svn.shibboleth.net/view/cpp-sp?rev=3534&view=rev

Logging supported for AuthnRequest, login, and logout operations using a single template string in OutOfProcess/@tranLogFormat

Tokens supported:

    m_handlers["e"] = _ExceptionMessage;
    m_handlers["E"] = _ExceptionType;
    m_handlers["S"] = _StatusCode;
    m_handlers["SS"] = _SubStatusCode;
    m_handlers["SM"] = _StatusMessage;
    m_handlers["URL"] = _URL;
    m_handlers["URI"] = _URI;
    m_handlers["s"] = _SessionID;
    m_handlers["a"] = _REMOTE_ADDR;
    m_handlers["UA"] = _UserAgent;
    m_handlers["app"] = _ApplicationID;
    m_handlers["SP"] = _SP_;
    m_handlers["IDP"] = _IDP;
    m_handlers["p"] = _Protocol;
    m_handlers["b"] = _Binding;
    m_handlers["n"] = _NameID;

    m_handlers["u"] = _REMOTE_USER;
    m_handlers["i"] = _AssertionID;
    m_handlers["I"] = _ProtocolID;
    m_handlers["II"] = _InResponseTo;
    m_handlers["d"] = _AssertionIssueInstant;
    m_handlers["D"] = _ProtocolIssueInstant;
    m_handlers["t"] = _AuthnInstant;
    m_handlers["x"] = _SessionIndex;
    m_handlers["ac"] = _AuthnContext;
    m_handlers["attr"] = _Attributes;

    m_handlers["L"] = _Logout;


> Parseable audit logs for SP
> ---------------------------
>
>                 Key: SSPCPP-349
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-349
>             Project: Shibboleth SP - C++
>          Issue Type: New Feature
>          Components: Logging
>            Reporter: Philip Brusten
>            Assignee: Scott Cantor
>             Fix For: 2.5
>
>   Original Estimate: 2 weeks
>          Time Spent: 3 days, 5 hours
>  Remaining Estimate: 4 hours
>
> It would be nice if we had an audit-log similar to the audit log from the IdP.
> The transaction log already provides some useful information, but is not easily parseable and does not contain a useful identifier of the user (e.g. REMOTE_USER variable)
> idp-audit.log format: auditEventTime|requestBinding|requestId|relyingPartyId|messageProfileId|assertingPartyId|responseBinding|responseId|principalName|authNMethod|releasedAttributeId1,releasedAttributeId2,|nameIdentifier|assertion1ID,assertion2ID,|
> I think, the SP audit log should contain at least the following fields delimited by a '|':
> - Authentication Time
> - SessionId
> - REMOTE_USER if any
> - Client IP address
> - Authentication Context Class
> - User-agent
> - Application id
> - entityID of SP
> - entityID of IdP
> - Protocol
> - Binding
> - filtered attribute IDs
> Could you take this into consideration?
> Regards,
> Philip

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira