[java-idp-plugin-duo] branch main updated: Improve INFO level logging
Phil Smart
philip.smart at jisc.ac.uk
Fri Dec 11 17:08:16 UTC 2020
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-duo.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=46be0c726717366f9fe4c8443478689913e97166
The following commit(s) were added to refs/heads/main by this push:
new 46be0c7 Improve INFO level logging
46be0c7 is described below
commit 46be0c726717366f9fe4c8443478689913e97166
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Dec 11 17:08:08 2020 +0000
Improve INFO level logging
---
.../plugin/authn/duo/impl/HealthCheckDuoOIDCAuthAPI.java | 5 ++---
.../plugin/authn/duo/impl/ValidateDuoResponseState.java | 4 ++--
.../duo/impl/ValidateDuoTokenAuthenticationResult.java | 2 +-
.../idp/plugin/authn/duo/impl/ValidateTokenSignature.java | 14 ++++++++------
4 files changed, 13 insertions(+), 12 deletions(-)
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/HealthCheckDuoOIDCAuthAPI.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/HealthCheckDuoOIDCAuthAPI.java
index 700dfd1..820d8bd 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/HealthCheckDuoOIDCAuthAPI.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/HealthCheckDuoOIDCAuthAPI.java
@@ -70,7 +70,6 @@ public class HealthCheckDuoOIDCAuthAPI extends AbstractDuoAuthenticationAction{
if (healthCheckResponse == null) {
//no response.
- log.info("{} No Duo 2FA health check response", getLogPrefix());
throw new DuoClientException("Duo 2FA is unavailable, null response from the "
+ "health check endpoint");
}
@@ -82,7 +81,7 @@ public class HealthCheckDuoOIDCAuthAPI extends AbstractDuoAuthenticationAction{
} else if (DuoOIDCAuthAPI.DUO_RESPONSE_STATUS_FAIL.equalsIgnoreCase(healthCheckResponse.getStatus())) {
//2FA is unavailable for the given client integration.
- log.info("{} Duo 2FA health check failed, current status '{}',"
+ log.error("{} Duo 2FA health check failed, current status '{}',"
+ " message '{}', message detail '{}'",getLogPrefix(),
healthCheckResponse.getStatus(),healthCheckResponse.getMessage(),
healthCheckResponse.getMessageDetail());
@@ -90,7 +89,7 @@ public class HealthCheckDuoOIDCAuthAPI extends AbstractDuoAuthenticationAction{
healthCheckResponse.getMessage());
} else {
- log.info("{} Duo health check response contained an unknown status of '{}', "
+ log.error("{} Duo health check response contained an unknown status of '{}', "
+ " message '{}', message detail '{}'",getLogPrefix(),
healthCheckResponse.getStatus(),
healthCheckResponse.getMessage(),healthCheckResponse.getMessageDetail());
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoResponseState.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoResponseState.java
index 39a39ba..da1e951 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoResponseState.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoResponseState.java
@@ -79,8 +79,8 @@ public class ValidateDuoResponseState extends AbstractDuoAuthenticationAction {
}
/**
- * Set the request and response states to null so they can't be reused - it is less
- * relevant if they are removed (GC'd) from memory.
+ * Set the request and response states to null so they can't be reused. There is no control
+ * on how long they persist in-memory.
*
* @param context the duo context.
*/
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
index b4115b4..53f73bd 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
@@ -180,7 +180,7 @@ public class ValidateDuoTokenAuthenticationResult extends AbstractValidationActi
final String authResultStatusMsg = (String)statusMsgObj;
if (DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW.equalsIgnoreCase(authResultStatus)){
- log.debug("{} Duo 2FA authentication succeeded for '{}'",getLogPrefix(),duoContext.getUsername());
+ log.info("{} Duo 2FA authentication succeeded for '{}'",getLogPrefix(),duoContext.getUsername());
recordSuccess(profileRequestContext);
buildAuthenticationResult(profileRequestContext, authenticationContext);
return;
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignature.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignature.java
index 95f655d..b88fbd8 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignature.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignature.java
@@ -114,14 +114,14 @@ public class ValidateTokenSignature extends AbstractDuoAuthenticationAction {
@Nonnull final AuthenticationContext authenticationContext,
@Nonnull final DuoOIDCAuthenticationContext duoContext) {
- log.info("{} Validating token signature for subject '{}'",getLogPrefix(),claimSet.getSubject());
+ log.debug("{} Validating token signature for subject '{}'",getLogPrefix(),claimSet.getSubject());
//only supports HMAC signatures. Asymmetric or 'none' are not allowed.
if (token instanceof PlainJWT || JWSAlgorithm.NONE == token.getHeader().getAlgorithm()) {
- log.error("{} Invalid token. Token must be signed using one of the supported algorithms '{}'",
- getLogPrefix(),SUPPORTED_SIGNATURE_FAMILY);
+ log.error("{} Invalid token for subject '{}'. Token must be signed using one of the supported "
+ + "algorithms '{}'",getLogPrefix(),claimSet.getSubject(),SUPPORTED_SIGNATURE_FAMILY);
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
@@ -135,8 +135,9 @@ public class ValidateTokenSignature extends AbstractDuoAuthenticationAction {
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
} else {
- log.debug("{} Token signature is valid; using algorithm family '{}' for client '{}'",
- getLogPrefix(),SUPPORTED_SIGNATURE_FAMILY, integration.getClientId());
+ log.debug("{} Token signature is valid for subject '{}'; using algorithm family "
+ + "'{}' for client '{}'", getLogPrefix(),claimSet.getSubject(),
+ SUPPORTED_SIGNATURE_FAMILY, integration.getClientId());
//Valid token
return;
}
@@ -156,7 +157,8 @@ public class ValidateTokenSignature extends AbstractDuoAuthenticationAction {
}
}
- log.error("{} Unable to validate token, unkown token type",getLogPrefix());
+ log.error("{} Unable to validate token for subject '{}' and client '{}', "
+ + "unkown token type",getLogPrefix(),claimSet.getSubject(),integration.getClientId());
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.AUTHN_EXCEPTION);
return;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list