[java-identity-provider] branch maint-4 updated: IDP-2039 - Add audit logging to login flows
Scott Cantor
cantor.2 at osu.edu
Thu Dec 15 20:32:49 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch maint-4
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=272fbf7fb40fa80126ce39227e2d61387b3d4760
The following commit(s) were added to refs/heads/maint-4 by this push:
new 272fbf7fb IDP-2039 - Add audit logging to login flows
272fbf7fb is described below
commit 272fbf7fb40fa80126ce39227e2d61387b3d4760
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Dec 15 15:32:43 2022 -0500
IDP-2039 - Add audit logging to login flows
https://shibboleth.atlassian.net/browse/IDP-2039
Add (SAML) request ID to logging fields and formats.
---
.../shibboleth/idp/flows/authn/authn-abstract-beans.xml | 15 +++++++++++++++
.../net/shibboleth/idp/flows/authn/duo-authn-beans.xml | 2 +-
.../shibboleth/idp/flows/authn/external-authn-beans.xml | 2 +-
.../shibboleth/idp/flows/authn/function-authn-beans.xml | 2 +-
.../shibboleth/idp/flows/authn/ipaddress-authn-beans.xml | 2 +-
.../shibboleth/idp/flows/authn/password-authn-beans.xml | 2 +-
.../shibboleth/idp/flows/authn/remoteuser-authn-beans.xml | 2 +-
.../idp/flows/authn/remoteuser-internal-authn-beans.xml | 2 +-
.../net/shibboleth/idp/flows/authn/spnego-authn-beans.xml | 2 +-
.../net/shibboleth/idp/flows/authn/x509-authn-beans.xml | 2 +-
.../idp/flows/authn/x509-internal-authn-beans.xml | 2 +-
11 files changed, 25 insertions(+), 10 deletions(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/authn-abstract-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/authn-abstract-beans.xml
index 1ee3fce68..6f329a1ed 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/authn-abstract-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/authn-abstract-beans.xml
@@ -92,6 +92,21 @@
</constructor-arg>
</bean>
</entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.REQUEST_ID"/>
+ </key>
+ <bean parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g">
+ <bean class="org.opensaml.saml.common.messaging.context.navigate.SAMLMessageInfoContextIDFunction" />
+ </constructor-arg>
+ <constructor-arg name="f">
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.ChildLookupOrCreate.SAMLMessageInfoContext"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
</map>
</property>
</bean>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/duo-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/duo-authn-beans.xml
index a32a5b94d..09478f7c7 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/duo-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/duo-authn-beans.xml
@@ -104,7 +104,7 @@
<util:map id="shibboleth.authn.AuditFormattingMap">
<entry key="#{'%{idp.authn.Duo.audit.category:Shibboleth-Audit.Duo}'.trim()}"
- value="#{'%{idp.authn.Duo.audit.format:%a|%T|%SP|%s|%AF|%u|%AR|%DuoCID|%DuoF|%DuoDID|%UA}'.trim()}" />
+ value="#{'%{idp.authn.Duo.audit.format:%a|%T|%SP|%I|%s|%AF|%u|%AR|%DuoCID|%DuoF|%DuoDID|%UA}'.trim()}" />
</util:map>
<bean id="shibboleth.authn.Duo.DefaultAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors" lazy-init="true"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/external-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/external-authn-beans.xml
index c82a36b66..fb0843f52 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/external-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/external-authn-beans.xml
@@ -43,7 +43,7 @@
<util:map id="shibboleth.authn.AuditFormattingMap">
<entry key="#{'%{idp.authn.External.audit.category:Shibboleth-Audit.External}'.trim()}"
- value="#{'%{idp.authn.External.audit.format:%a|%T|%SP|%s|%AF|%u|%AR|%UA}'.trim()}" />
+ value="#{'%{idp.authn.External.audit.format:%a|%T|%SP|%I|%s|%AF|%u|%AR|%UA}'.trim()}" />
</util:map>
<bean id="shibboleth.authn.External.DefaultAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors" lazy-init="true"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/function-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/function-authn-beans.xml
index 93f8db662..7bbab0d07 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/function-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/function-authn-beans.xml
@@ -42,7 +42,7 @@
<util:map id="shibboleth.authn.AuditFormattingMap">
<entry key="#{'%{idp.authn.Function.audit.category:Shibboleth-Audit.Function}'.trim()}"
- value="#{'%{idp.authn.Function.audit.format:%a|%T|%SP|%s|%AF|%u|%AR|%UA}'.trim()}" />
+ value="#{'%{idp.authn.Function.audit.format:%a|%T|%SP|%I|%s|%AF|%u|%AR|%UA}'.trim()}" />
</util:map>
<bean id="shibboleth.authn.Function.DefaultAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors" lazy-init="true"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/ipaddress-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/ipaddress-authn-beans.xml
index 3be40a959..f08ed2ce3 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/ipaddress-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/ipaddress-authn-beans.xml
@@ -42,7 +42,7 @@
<!-- Default audit format and extractors -->
<util:map id="shibboleth.authn.AuditFormattingMap">
<entry key="#{'%{idp.authn.IPAddress.audit.category:Shibboleth-Audit.IPAddress}'.trim()}"
- value="#{'%{idp.authn.IPAddress.audit.format:%a|%T|%SP|%s|%AF|%CV|%u|%AR|%UA}'.trim()}" />
+ value="#{'%{idp.authn.IPAddress.audit.format:%a|%T|%SP|%I|%s|%AF|%CV|%u|%AR|%UA}'.trim()}" />
</util:map>
<bean id="shibboleth.authn.IPAddress.DefaultAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors" lazy-init="true"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/password-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/password-authn-beans.xml
index fadcda3e5..12ea01f39 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/password-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/password-authn-beans.xml
@@ -180,7 +180,7 @@
<!-- Default audit format and extractors -->
<util:map id="shibboleth.authn.AuditFormattingMap">
<entry key="#{'%{idp.authn.Password.audit.category:Shibboleth-Audit.Password}'.trim()}"
- value="#{'%{idp.authn.Password.audit.format:%a|%T|%SP|%s|%AF|%CV|%u|%tu|%AR|%UA}'.trim()}" />
+ value="#{'%{idp.authn.Password.audit.format:%a|%T|%SP|%I|%s|%AF|%CV|%u|%tu|%AR|%UA}'.trim()}" />
</util:map>
<bean id="shibboleth.authn.Password.DefaultAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors" lazy-init="true"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-beans.xml
index 0364ca2b3..55e2cbb35 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-beans.xml
@@ -42,7 +42,7 @@
<util:map id="shibboleth.authn.AuditFormattingMap">
<entry key="#{'%{idp.authn.RemoteUser.audit.category:Shibboleth-Audit.RemoteUser}'.trim()}"
- value="#{'%{idp.authn.RemoteUser.audit.format:%a|%T|%SP|%s|%AF|%CV|%u|%AR|%UA}'.trim()}" />
+ value="#{'%{idp.authn.RemoteUser.audit.format:%a|%T|%SP|%I|%s|%AF|%CV|%u|%AR|%UA}'.trim()}" />
</util:map>
<bean id="shibboleth.authn.RemoteUser.DefaultAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors" lazy-init="true"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-internal-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-internal-authn-beans.xml
index 2366e5dd8..21bf6c66f 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-internal-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-internal-authn-beans.xml
@@ -73,7 +73,7 @@
<util:map id="shibboleth.authn.AuditFormattingMap">
<entry key="#{'%{idp.authn.RemoteUserInternal.audit.category:Shibboleth-Audit.RemoteUserInternal}'.trim()}"
- value="#{'%{idp.authn.RemoteUserInternal.audit.format:%a|%T|%SP|%s|%AF|%CV|%u|%AR|%UA}'.trim()}" />
+ value="#{'%{idp.authn.RemoteUserInternal.audit.format:%a|%T|%SP|%I|%s|%AF|%CV|%u|%AR|%UA}'.trim()}" />
</util:map>
<bean id="shibboleth.authn.RemoteUserInternal.DefaultAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors" lazy-init="true"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/spnego-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/spnego-authn-beans.xml
index a123b4bfb..f3556fc13 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/spnego-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/spnego-authn-beans.xml
@@ -68,7 +68,7 @@
<util:map id="shibboleth.authn.AuditFormattingMap">
<entry key="#{'%{idp.authn.SPNEGO.audit.category:Shibboleth-Audit.SPNEGO}'.trim()}"
- value="#{'%{idp.authn.SPNEGO.audit.format:%a|%T|%SP|%s|%AF|%u|%AR|%UA}'.trim()}" />
+ value="#{'%{idp.authn.SPNEGO.audit.format:%a|%T|%SP|%I|%s|%AF|%u|%AR|%UA}'.trim()}" />
</util:map>
<bean id="shibboleth.authn.SPNEGO.DefaultAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors" lazy-init="true"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-authn-beans.xml
index d9fc49f7c..68662d80e 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-authn-beans.xml
@@ -44,7 +44,7 @@
<util:map id="shibboleth.authn.AuditFormattingMap">
<entry key="#{'%{idp.authn.X509.audit.category:Shibboleth-Audit.X509}'.trim()}"
- value="#{'%{idp.authn.X509.audit.format:%a|%T|%SP|%s|%AF|%X509S|%X509I|%AR|%UA}'.trim()}" />
+ value="#{'%{idp.authn.X509.audit.format:%a|%T|%SP|%I|%s|%AF|%X509S|%X509I|%AR|%UA}'.trim()}" />
</util:map>
<bean id="shibboleth.authn.X509.DefaultAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors" lazy-init="true"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-internal-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-internal-authn-beans.xml
index 97212f2ea..1ce3a712d 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-internal-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-internal-authn-beans.xml
@@ -46,7 +46,7 @@
<util:map id="shibboleth.authn.AuditFormattingMap">
<entry key="#{'%{idp.authn.X509Internal.audit.category:Shibboleth-Audit.X509Internal}'.trim()}"
- value="#{'%{idp.authn.X509Internal.audit.format:%a|%T|%SP|%s|%AF|%X509S|%X509I|%AR|%UA}'.trim()}" />
+ value="#{'%{idp.authn.X509Internal.audit.format:%a|%T|%SP|%I|%s|%AF|%X509S|%X509I|%AR|%UA}'.trim()}" />
</util:map>
<bean id="shibboleth.authn.X509Internal.DefaultAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors" lazy-init="true"
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list