[JIRA] (JOIDC-112) OP_OIDC_MESSAGES log appender to trace all the exchanged protocol messages

[Henri Mikkonen (Jira)]

Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) *commented* on JOIDC-112 ( https://shibboleth.atlassian.net/browse/JOIDC-112?atlOrigin=eyJpIjoiMzgxNTM0YzFhNTFhNDQ1YmJmZTA2OWU5OGY4MWU1OTAiLCJwIjoiaiJ9 )

Re: OP_OIDC_MESSAGES log appender to trace all the exchanged protocol messages ( https://shibboleth.atlassian.net/browse/JOIDC-112?atlOrigin=eyJpIjoiMzgxNTM0YzFhNTFhNDQ1YmJmZTA2OWU5OGY4MWU1OTAiLCJwIjoiaiJ9 )

During the last dev call it was agreed that the best candidate for log appender would be *PROTOCOL_MESSAGE.OAUTH2*.

After working a bit on this, it now feels that we should probably leave the existing class loggers in place. On DEBUG-level they can already be used for debugging all the details of the request messages in raw, including sensitive data such as client secrets in some use cases. That can be very useful in some pre-production deployments, but shouldn’t hardly ever be enabled in production.

Thus it feels that the *PROTOCOL_MESSAGE* appender should only log the details from the request or response message objects after they have been decoded/encoded. Then we can use for instance MoreObjects.toStringHelper() to build the log-lines in a "controlled" way: avoid logging sensitive data like client secrets, but include details like client authentication method.

Downside is that as the Nimbus request/response objects don’t have a generic toString() method, we need to implement a message-specific method for constructing the log-lines. Those would get their contents by using getter-methods of the Nimbus message objects. This is more complicated in comparison to the current class loggers that simply log all HTTP headers and parameters, but this way we fully control what we want to log about each message object.

( https://shibboleth.atlassian.net/browse/JOIDC-112#add-comment?atlOrigin=eyJpIjoiMzgxNTM0YzFhNTFhNDQ1YmJmZTA2OWU5OGY4MWU1OTAiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-112#add-comment?atlOrigin=eyJpIjoiMzgxNTM0YzFhNTFhNDQ1YmJmZTA2OWU5OGY4MWU1OTAiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100201- sha1:5c1db44 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220622/769ee9d5/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-02a0d8ad-bf2b-4542-a020-7ed032380d03
Type: image/png
Size: 341 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220622/769ee9d5/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-1d4aa74b-5dd8-4810-a39d-35c8cda94091
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220622/769ee9d5/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-f2a6ffd6-1981-4a6b-ad31-4137dac43cec
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220622/769ee9d5/attachment-0005.png>