[java-identity-provider] 09/11: IDP-2039 - Add audit logging to login flows
Scott Cantor
cantor.2 at osu.edu
Tue Jan 3 22:01:49 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=a9a35b1310a2dd1b4e37d17d185c3e80a7a984a8
commit a9a35b1310a2dd1b4e37d17d185c3e80a7a984a8
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Dec 15 15:32:43 2022 -0500
IDP-2039 - Add audit logging to login flows
https://shibboleth.atlassian.net/browse/IDP-2039
Add (SAML) request ID to logging fields and formats.
---
.../shibboleth/idp/flows/authn/authn-abstract-beans.xml | 15 +++++++++++++++
.../net/shibboleth/idp/flows/authn/duo-authn-beans.xml | 2 +-
.../shibboleth/idp/flows/authn/external-authn-beans.xml | 2 +-
.../shibboleth/idp/flows/authn/function-authn-beans.xml | 2 +-
.../shibboleth/idp/flows/authn/ipaddress-authn-beans.xml | 2 +-
.../shibboleth/idp/flows/authn/password-authn-beans.xml | 2 +-
.../shibboleth/idp/flows/authn/remoteuser-authn-beans.xml | 2 +-
.../idp/flows/authn/remoteuser-internal-authn-beans.xml | 2 +-
.../net/shibboleth/idp/flows/authn/spnego-authn-beans.xml | 2 +-
.../net/shibboleth/idp/flows/authn/x509-authn-beans.xml | 2 +-
.../idp/flows/authn/x509-internal-authn-beans.xml | 2 +-
11 files changed, 25 insertions(+), 10 deletions(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/authn-abstract-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/authn-abstract-beans.xml
index 1ee3fce68..6f329a1ed 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/authn-abstract-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/authn-abstract-beans.xml
@@ -92,6 +92,21 @@
</constructor-arg>
</bean>
</entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.REQUEST_ID"/>
+ </key>
+ <bean parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g">
+ <bean class="org.opensaml.saml.common.messaging.context.navigate.SAMLMessageInfoContextIDFunction" />
+ </constructor-arg>
+ <constructor-arg name="f">
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.ChildLookupOrCreate.SAMLMessageInfoContext"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
</map>
</property>
</bean>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/duo-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/duo-authn-beans.xml
index 5a315a064..a22f3a4c2 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/duo-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/duo-authn-beans.xml
@@ -104,7 +104,7 @@
<util:map id="shibboleth.authn.AuditFormattingMap">
<entry key="#{'%{idp.authn.Duo.audit.category:Shibboleth-Audit.Duo}'.trim()}"
- value="#{'%{idp.authn.Duo.audit.format:%a|%T|%SP|%s|%AF|%u|%AR|%DuoCID|%DuoF|%DuoDID|%UA}'.trim()}" />
+ value="#{'%{idp.authn.Duo.audit.format:%a|%T|%SP|%I|%s|%AF|%u|%AR|%DuoCID|%DuoF|%DuoDID|%UA}'.trim()}" />
</util:map>
<bean id="shibboleth.authn.Duo.DefaultAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors" lazy-init="true"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/external-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/external-authn-beans.xml
index 0428827e2..0be91522a 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/external-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/external-authn-beans.xml
@@ -43,7 +43,7 @@
<util:map id="shibboleth.authn.AuditFormattingMap">
<entry key="#{'%{idp.authn.External.audit.category:Shibboleth-Audit.External}'.trim()}"
- value="#{'%{idp.authn.External.audit.format:%a|%T|%SP|%s|%AF|%u|%AR|%UA}'.trim()}" />
+ value="#{'%{idp.authn.External.audit.format:%a|%T|%SP|%I|%s|%AF|%u|%AR|%UA}'.trim()}" />
</util:map>
<bean id="shibboleth.authn.External.DefaultAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors" lazy-init="true"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/function-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/function-authn-beans.xml
index 72d53726c..d9bbe4e2a 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/function-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/function-authn-beans.xml
@@ -42,7 +42,7 @@
<util:map id="shibboleth.authn.AuditFormattingMap">
<entry key="#{'%{idp.authn.Function.audit.category:Shibboleth-Audit.Function}'.trim()}"
- value="#{'%{idp.authn.Function.audit.format:%a|%T|%SP|%s|%AF|%u|%AR|%UA}'.trim()}" />
+ value="#{'%{idp.authn.Function.audit.format:%a|%T|%SP|%I|%s|%AF|%u|%AR|%UA}'.trim()}" />
</util:map>
<bean id="shibboleth.authn.Function.DefaultAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors" lazy-init="true"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/ipaddress-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/ipaddress-authn-beans.xml
index b9dbcdeaf..04b1d9ab1 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/ipaddress-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/ipaddress-authn-beans.xml
@@ -42,7 +42,7 @@
<!-- Default audit format and extractors -->
<util:map id="shibboleth.authn.AuditFormattingMap">
<entry key="#{'%{idp.authn.IPAddress.audit.category:Shibboleth-Audit.IPAddress}'.trim()}"
- value="#{'%{idp.authn.IPAddress.audit.format:%a|%T|%SP|%s|%AF|%CV|%u|%AR|%UA}'.trim()}" />
+ value="#{'%{idp.authn.IPAddress.audit.format:%a|%T|%SP|%I|%s|%AF|%CV|%u|%AR|%UA}'.trim()}" />
</util:map>
<bean id="shibboleth.authn.IPAddress.DefaultAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors" lazy-init="true"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/password-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/password-authn-beans.xml
index aeb78921d..e11819380 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/password-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/password-authn-beans.xml
@@ -174,7 +174,7 @@
<!-- Default audit format and extractors -->
<util:map id="shibboleth.authn.AuditFormattingMap">
<entry key="#{'%{idp.authn.Password.audit.category:Shibboleth-Audit.Password}'.trim()}"
- value="#{'%{idp.authn.Password.audit.format:%a|%T|%SP|%s|%AF|%CV|%u|%tu|%AR|%UA}'.trim()}" />
+ value="#{'%{idp.authn.Password.audit.format:%a|%T|%SP|%I|%s|%AF|%CV|%u|%tu|%AR|%UA}'.trim()}" />
</util:map>
<bean id="shibboleth.authn.Password.DefaultAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors" lazy-init="true"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-beans.xml
index a33344a51..ce9d6a6cc 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-beans.xml
@@ -42,7 +42,7 @@
<util:map id="shibboleth.authn.AuditFormattingMap">
<entry key="#{'%{idp.authn.RemoteUser.audit.category:Shibboleth-Audit.RemoteUser}'.trim()}"
- value="#{'%{idp.authn.RemoteUser.audit.format:%a|%T|%SP|%s|%AF|%CV|%u|%AR|%UA}'.trim()}" />
+ value="#{'%{idp.authn.RemoteUser.audit.format:%a|%T|%SP|%I|%s|%AF|%CV|%u|%AR|%UA}'.trim()}" />
</util:map>
<bean id="shibboleth.authn.RemoteUser.DefaultAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors" lazy-init="true"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-internal-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-internal-authn-beans.xml
index 295b0f558..0f49851b9 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-internal-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-internal-authn-beans.xml
@@ -73,7 +73,7 @@
<util:map id="shibboleth.authn.AuditFormattingMap">
<entry key="#{'%{idp.authn.RemoteUserInternal.audit.category:Shibboleth-Audit.RemoteUserInternal}'.trim()}"
- value="#{'%{idp.authn.RemoteUserInternal.audit.format:%a|%T|%SP|%s|%AF|%CV|%u|%AR|%UA}'.trim()}" />
+ value="#{'%{idp.authn.RemoteUserInternal.audit.format:%a|%T|%SP|%I|%s|%AF|%CV|%u|%AR|%UA}'.trim()}" />
</util:map>
<bean id="shibboleth.authn.RemoteUserInternal.DefaultAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors" lazy-init="true"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/spnego-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/spnego-authn-beans.xml
index 2e9883b66..238d717a5 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/spnego-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/spnego-authn-beans.xml
@@ -68,7 +68,7 @@
<util:map id="shibboleth.authn.AuditFormattingMap">
<entry key="#{'%{idp.authn.SPNEGO.audit.category:Shibboleth-Audit.SPNEGO}'.trim()}"
- value="#{'%{idp.authn.SPNEGO.audit.format:%a|%T|%SP|%s|%AF|%u|%AR|%UA}'.trim()}" />
+ value="#{'%{idp.authn.SPNEGO.audit.format:%a|%T|%SP|%I|%s|%AF|%u|%AR|%UA}'.trim()}" />
</util:map>
<bean id="shibboleth.authn.SPNEGO.DefaultAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors" lazy-init="true"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-authn-beans.xml
index d0db1f98f..7d943d88c 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-authn-beans.xml
@@ -44,7 +44,7 @@
<util:map id="shibboleth.authn.AuditFormattingMap">
<entry key="#{'%{idp.authn.X509.audit.category:Shibboleth-Audit.X509}'.trim()}"
- value="#{'%{idp.authn.X509.audit.format:%a|%T|%SP|%s|%AF|%X509S|%X509I|%AR|%UA}'.trim()}" />
+ value="#{'%{idp.authn.X509.audit.format:%a|%T|%SP|%I|%s|%AF|%X509S|%X509I|%AR|%UA}'.trim()}" />
</util:map>
<bean id="shibboleth.authn.X509.DefaultAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors" lazy-init="true"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-internal-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-internal-authn-beans.xml
index ce454b6e2..711062938 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-internal-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-internal-authn-beans.xml
@@ -46,7 +46,7 @@
<util:map id="shibboleth.authn.AuditFormattingMap">
<entry key="#{'%{idp.authn.X509Internal.audit.category:Shibboleth-Audit.X509Internal}'.trim()}"
- value="#{'%{idp.authn.X509Internal.audit.format:%a|%T|%SP|%s|%AF|%X509S|%X509I|%AR|%UA}'.trim()}" />
+ value="#{'%{idp.authn.X509Internal.audit.format:%a|%T|%SP|%I|%s|%AF|%X509S|%X509I|%AR|%UA}'.trim()}" />
</util:map>
<bean id="shibboleth.authn.X509Internal.DefaultAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors" lazy-init="true"
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list