[JIRA] (JOIDC-112) OP_OIDC_MESSAGES log appender to trace all the exchanged protocol messages

[Henri Mikkonen (Jira)]

Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) *commented* on JOIDC-112 ( https://shibboleth.atlassian.net/browse/JOIDC-112?atlOrigin=eyJpIjoiZjA3YmQwM2M2MzBhNGU2ODg4MzdkMmRmZWIxOGY3N2MiLCJwIjoiaiJ9 )

Re: OP_OIDC_MESSAGES log appender to trace all the exchanged protocol messages ( https://shibboleth.atlassian.net/browse/JOIDC-112?atlOrigin=eyJpIjoiZjA3YmQwM2M2MzBhNGU2ODg4MzdkMmRmZWIxOGY3N2MiLCJwIjoiaiJ9 )

It sounds doable to make the decoders in net.shibboleth.idp.plugin.oidc.op.oauth2.decoding.impl and net.shibboleth.idp.plugin.oidc.op.decoding.impl packages to exploit the *PROTOCOL_MESSAGE* appender. Also  {{ net.shibboleth.idp.plugin.oidc.op.encoding.impl.NimbusResponseEncode }} r could use it for logging the outgoing messages.

In addition to those, to be inline with SAML logging, we should probably log the unencrypted id_token and/or userinfo response too, if encryption is enabled?

Currently the DEBUG level for the packages mentioned above produces the log entries as shown below: in addition to request message parameters, also the headers are shown. Do we want to log the headers in all cases, or should it be configurable? Actually both headers and parameters may contain client_secrets in plaintext, so should the contents be somehow configurable? Also, In some cases, it might not be desired to log full access/refresh token values.

2022-06-09 10:33:00,863 - xx.xx.xx.xx - DEBUG [net.shibboleth.idp.plugin.oidc.op.decoding.impl.OIDCAuthenticationRequestDecoder:49] - Inbound request GET
Headers:
	Accept:[text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8]
	Accept-Encoding:[gzip, deflate, br]
	Accept-Language:[en-US,en;q=0.5]
	Connection:[keep-alive]
	Content-Type:[null]
	Cookie:[JSESSIONID=node01u726jb50r2r100fwqa755vj30.node0; shib_idp_session=f855c9e09981478bc974ac1da5e77a6af506725a46c21ba9afd674702ad50339; _opensaml_req_ss%3Amem%3A68369ceb4f9f5d6604361df117b275ad8dc92f384a4ed91a1a25f77e50266725=_9bdf8b5df520cc3fec1c0c50b1caf844; mod_auth_openidc_state_PRMb1XTpvPWUZLf6Ic-44DrCqbk=1V0SVBm8EATdOo-gW3YP1YioyCrNZ6rDQwGpKP5nGuxdf9DrHjw5Ud8zlrvbg4_A40je3_9HQuAOUo-0zKW0YGsNqlxPVNOGcY8S16lYJJqCvuXXTpdQG4aif-DOenX1mrdAIKLOu-tGPkToi3WL4WtV8XW3PreziVrMd9h6VYdESjgR8pCZ8piuN8bwY4lIobXdo8y3iyGT0suHnIuLR8YZOkui3OCGuALIXHeq2tsjJRK5fizGM3uO5E1K4cvRIuhaAJqs7U8BPzo1DhROTa77DSd-rDQUe536zLdkkGy7Mwdewls45HeO1iMss6NU]
	Host:[xx.xx.fi]
	Sec-Fetch-Dest:[document]
	Sec-Fetch-Mode:[navigate]
	Sec-Fetch-Site:[none]
	Sec-Fetch-User:[?1]
	Upgrade-Insecure-Requests:[1]
	User-Agent:[Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:101.0) Gecko/20100101 Firefox/101.0]
	X-Forwarded-For:[yy.yy.yy.yy]
	X-Forwarded-Host:[xx.xx.fi]
	X-Forwarded-Proto:[https]
	X-Forwarded-Server:[xx.xx.fi]
Parameters:
	scope:openid profile email address phone offline_access
	response_type:code
	state:PRMb1XTpvPWUZLf6Ic-44DrCqbk
	redirect_uri:https://xx.xx.fi/protected/redirect_uri
	nonce:acTAMAGnm14YkY-7gnBBl8Jd5OEV-c0FJVcrXeFzymk
	client_id:test_rp_saml

( https://shibboleth.atlassian.net/browse/JOIDC-112#add-comment?atlOrigin=eyJpIjoiZjA3YmQwM2M2MzBhNGU2ODg4MzdkMmRmZWIxOGY3N2MiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-112#add-comment?atlOrigin=eyJpIjoiZjA3YmQwM2M2MzBhNGU2ODg4MzdkMmRmZWIxOGY3N2MiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100200- sha1:9199305 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220609/d52ec6a0/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-f13f2bde-f6e1-45b4-a8cd-7e583ad00ce1
Type: image/png
Size: 341 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220609/d52ec6a0/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-327f8e12-0f6f-431e-8eef-cd4b2f5d9e68
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220609/d52ec6a0/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-bb98972e-29ad-48ac-b352-ecabe25c6590
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220609/d52ec6a0/attachment-0005.png>