[java-identity-provider] branch main updated: IDP-2465 - 5.2.3 broke logback filters due to removal of JaninoEvaluator
Codeberg
noreply at shibboleth.net
Wed Oct 14 14:33:33 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
https://codeberg.org/Shibboleth/java-identity-provider/commit/21077809eee82fc23f4f365f673bba6b322a719a
The following commit(s) were added to refs/heads/main by this push:
new 21077809e IDP-2465 - 5.2.3 broke logback filters due to removal of JaninoEvaluator
21077809e is described below
commit 21077809eee82fc23f4f365f673bba6b322a719a
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Wed Oct 14 10:33:20 2026 -0400
IDP-2465 - 5.2.3 broke logback filters due to removal of JaninoEvaluator
https://shibboleth.atlassian.net/browse/IDP-2465
Ported in a contribution to supply an Evaluator.
Added logback to an idp-core compile dep.
Removed logback as runtime dep. in distro pom.
Removed Janino dependency from IdP.
---
idp-conf-impl/pom.xml | 5 -
.../net/shibboleth/idp/module/conf/logback.xml | 18 +-
.../net/shibboleth/idp/module/conf/logback.xml | 216 ---------------------
idp-core/pom.xml | 12 ++
.../shibboleth/idp/logging/LogbackEvaluator.java | 79 ++++++++
.../net/shibboleth/idp/logging/package-info.java | 18 ++
idp-war-distribution/pom.xml | 17 --
7 files changed, 115 insertions(+), 250 deletions(-)
diff --git a/idp-conf-impl/pom.xml b/idp-conf-impl/pom.xml
index 55ab1b0c5..0bb080d52 100644
--- a/idp-conf-impl/pom.xml
+++ b/idp-conf-impl/pom.xml
@@ -310,11 +310,6 @@
<artifactId>hsqldb</artifactId>
<scope>test</scope>
</dependency>
- <dependency>
- <groupId>org.codehaus.janino</groupId>
- <artifactId>janino</artifactId>
- <scope>test</scope>
- </dependency>
<dependency>
<groupId>org.ldaptive</groupId>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/logback.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/logback.xml
index 71529dd28..3c0727660 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/logback.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/logback.xml
@@ -95,12 +95,9 @@
<!-- Ignore Velocity status page error. -->
<filter class="ch.qos.logback.core.filter.EvaluatorFilter">
- <evaluator>
- <matcher>
- <Name>VelocityStatusMatcher</Name>
- <regex>ResourceManager\s*: unable to find resource 'status\.vm' in any resource loader\.</regex>
- </matcher>
- <expression>VelocityStatusMatcher.matches(formattedMessage)</expression>
+ <evaluator class="net.shibboleth.idp.logging.LogbackEvaluator">
+ <loggerPattern>^org\.apache\.velocity\.loader$</loggerPattern>
+ <messagePattern>status\.vm</messagePattern>
</evaluator>
<OnMatch>DENY</OnMatch>
</filter>
@@ -131,12 +128,9 @@
<!-- Ignore Velocity status page error. -->
<filter class="ch.qos.logback.core.filter.EvaluatorFilter">
- <evaluator>
- <matcher>
- <Name>VelocityStatusMatcher</Name>
- <regex>ResourceManager\s*: unable to find resource 'status\.vm' in any resource loader\.</regex>
- </matcher>
- <expression>VelocityStatusMatcher.matches(formattedMessage)</expression>
+ <evaluator class="net.shibboleth.idp.logging.LogbackEvaluator">
+ <loggerPattern>^org\.apache\.velocity\.loader$</loggerPattern>
+ <messagePattern>status\.vm</messagePattern>
</evaluator>
<OnMatch>DENY</OnMatch>
</filter>
diff --git a/idp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/logback.xml b/idp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/logback.xml
deleted file mode 100644
index 85e6cc0fd..000000000
--- a/idp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/logback.xml
+++ /dev/null
@@ -1,216 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<configuration>
-
- <!--
- Variables for simplifying logging configuration.
- http://logback.qos.ch/manual/configuration.html#variableSubstitution
- -->
-
- <!--
- If you want to use custom properties in this config file,
- we load the main property file for you.
- -->
- <variable file="${idp.home}/conf/idp.properties" />
-
- <!-- Location and retention. -->
-
- <variable name="idp.logfiles" value="${idp.logfiles:-${idp.home}/logs}" />
- <variable name="idp.loghistory" value="${idp.loghistory:-180}" />
-
- <!-- Much higher performance if you operate on DEBUG. -->
- <!-- <variable name="idp.process.appender" value="ASYNC_PROCESS" /> -->
-
- <!-- Logging level shortcuts. -->
- <variable name="idp.loglevel.idp" value="${idp.loglevel.idp:-INFO}" />
- <variable name="idp.loglevel.ldap" value="${idp.loglevel.ldap:-WARN}" />
- <variable name="idp.loglevel.messages" value="${idp.loglevel.messages:-INFO}" />
- <variable name="idp.loglevel.encryption" value="${idp.loglevel.encryption:-INFO}" />
- <variable name="idp.loglevel.opensaml" value="${idp.loglevel.opensaml:-INFO}" />
- <variable name="idp.loglevel.props" value="${idp.loglevel.props:-INFO}" />
- <variable name="idp.loglevel.httpclient" value="${idp.loglevel.httpclient:-INFO}" />
-
- <!-- Don't turn these up unless you want a *lot* of noise. -->
- <variable name="idp.loglevel.spring" value="${idp.loglevel.spring:-ERROR}" />
- <variable name="idp.loglevel.container" value="${idp.loglevel.container:-ERROR}" />
- <variable name="idp.loglevel.xmlsec" value="${idp.loglevel.xmlsec:-INFO}" />
-
- <!-- =========================================================== -->
- <!-- ============== Logging Categories and Levels ============== -->
- <!-- =========================================================== -->
-
- <!-- Logs IdP, but not OpenSAML, messages -->
- <logger name="net.shibboleth.idp" level="${idp.loglevel.idp}"/>
-
- <!-- Logs OpenSAML, but not IdP, messages -->
- <logger name="org.opensaml.saml" level="${idp.loglevel.opensaml}"/>
-
- <!-- Logs LDAP related messages -->
- <logger name="org.ldaptive" level="${idp.loglevel.ldap}"/>
-
- <!-- Logs embedded HTTP client messages -->
- <logger name="org.apache.hc" level="${idp.loglevel.httpclient}"/>
-
- <!-- Logs inbound and outbound protocols messages at DEBUG level -->
- <logger name="PROTOCOL_MESSAGE" level="${idp.loglevel.messages}" />
-
- <!-- Logs unencrypted SAML at DEBUG level -->
- <logger name="org.opensaml.saml.saml2.encryption.Encrypter" level="${idp.loglevel.encryption}" />
- <logger name="org.opensaml.saml.saml2.encryption.Decrypter" level="${idp.loglevel.encryption}" />
-
- <!-- Logs system properties during startup at DEBUG level -->
- <logger name="net.shibboleth.idp.log.LogbackLoggingService" level="${idp.loglevel.props}" />
-
- <!-- Especially chatty. -->
- <logger name="org.apache.xml.security" level="${idp.loglevel.xmlsec}" />
- <logger name="org.springframework" level="${idp.loglevel.spring}"/>
- <logger name="org.apache.catalina" level="${idp.loglevel.container}"/>
- <logger name="org.eclipse.jetty" level="${idp.loglevel.container}"/>
-
-
- <!-- =========================================================== -->
- <!-- ============== Low Level Details or Changes =============== -->
- <!-- =========================================================== -->
-
- <!-- Process log. -->
- <appender name="IDP_PROCESS" class="ch.qos.logback.core.rolling.RollingFileAppender">
- <File>${idp.logfiles}/idp-process.log</File>
-
- <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
- <fileNamePattern>${idp.logfiles}/idp-process-%d{yyyy-MM-dd}.log.gz</fileNamePattern>
- <maxHistory>${idp.loghistory}</maxHistory>
- </rollingPolicy>
-
- <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
- <charset>UTF-8</charset>
- <Pattern>%date{ISO8601} - %mdc{idp.remote_addr} - %level [%logger:%line] - %msg%n%ex{short}</Pattern>
- </encoder>
-
- <!-- Ignore Velocity status page error. -->
- <filter class="ch.qos.logback.core.filter.EvaluatorFilter">
- <evaluator>
- <matcher>
- <Name>VelocityStatusMatcher</Name>
- <regex>ResourceManager\s*: unable to find resource 'status\.vm' in any resource loader\.</regex>
- </matcher>
- <expression>VelocityStatusMatcher.matches(formattedMessage)</expression>
- </evaluator>
- <OnMatch>DENY</OnMatch>
- </filter>
- </appender>
-
- <appender name="ASYNC_PROCESS" class="ch.qos.logback.classic.AsyncAppender">
- <appender-ref ref="IDP_PROCESS" />
- <discardingThreshold>0</discardingThreshold>
- </appender>
-
- <appender name="IDP_WARN" class="ch.qos.logback.core.rolling.RollingFileAppender">
- <!-- Suppress anything below WARN. -->
- <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
- <level>WARN</level>
- </filter>
-
- <File>${idp.logfiles}/idp-warn.log</File>
-
- <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
- <fileNamePattern>${idp.logfiles}/idp-warn-%d{yyyy-MM-dd}.log.gz</fileNamePattern>
- <maxHistory>${idp.loghistory}</maxHistory>
- </rollingPolicy>
-
- <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
- <charset>UTF-8</charset>
- <Pattern>%date{ISO8601} - %mdc{idp.remote_addr} - %level [%logger:%line] - %msg%n%ex{full}</Pattern>
- </encoder>
-
- <!-- Ignore Velocity status page error. -->
- <filter class="ch.qos.logback.core.filter.EvaluatorFilter">
- <evaluator>
- <matcher>
- <Name>VelocityStatusMatcher</Name>
- <regex>ResourceManager\s*: unable to find resource 'status\.vm' in any resource loader\.</regex>
- </matcher>
- <expression>VelocityStatusMatcher.matches(formattedMessage)</expression>
- </evaluator>
- <OnMatch>DENY</OnMatch>
- </filter>
- </appender>
-
- <!-- Audit log. -->
- <appender name="IDP_AUDIT" class="ch.qos.logback.core.rolling.RollingFileAppender">
- <File>${idp.logfiles}/idp-audit.log</File>
-
- <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
- <fileNamePattern>${idp.logfiles}/idp-audit-%d{yyyy-MM-dd}.log.gz</fileNamePattern>
- <maxHistory>${idp.loghistory}</maxHistory>
- </rollingPolicy>
-
- <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
- <charset>UTF-8</charset>
- <Pattern>%msg%n</Pattern>
- </encoder>
- </appender>
-
- <!-- Consent audit log. -->
- <appender name="IDP_CONSENT_AUDIT" class="ch.qos.logback.core.rolling.RollingFileAppender">
- <File>${idp.logfiles}/idp-consent-audit.log</File>
-
- <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
- <fileNamePattern>${idp.logfiles}/idp-consent-audit-%d{yyyy-MM-dd}.log.gz</fileNamePattern>
- <maxHistory>${idp.loghistory}</maxHistory>
- </rollingPolicy>
-
- <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
- <charset>UTF-8</charset>
- <Pattern>%msg%n</Pattern>
- </encoder>
- </appender>
-
- <!-- F-TICKS syslog destination. -->
- <appender name="IDP_FTICKS" class="ch.qos.logback.classic.net.SyslogAppender">
- <syslogHost>${idp.fticks.loghost:-localhost}</syslogHost>
- <port>${idp.fticks.logport:-514}</port>
- <facility>AUTH</facility>
- <suffixPattern>[%thread] %logger %msg</suffixPattern>
- </appender>
-
- <!-- Top level loggers. -->
-
- <logger name="Shibboleth-Audit" level="ALL">
- <appender-ref ref="${idp.audit.appender:-IDP_AUDIT}"/>
- </logger>
-
- <logger name="Shibboleth-FTICKS" level="ALL" additivity="false">
- <appender-ref ref="${idp.fticks.appender:-IDP_FTICKS}"/>
- </logger>
-
- <logger name="Shibboleth-Consent-Audit" level="ALL">
- <appender-ref ref="${idp.consent.appender:-IDP_CONSENT_AUDIT}"/>
- </logger>
-
- <root level="${idp.loglevel.root:-INFO}">
- <appender-ref ref="${idp.process.appender:-IDP_PROCESS}"/>
- <appender-ref ref="${idp.warn.appender:-IDP_WARN}" />
- </root>
-
- <!-- Example routing Password flow auditing to separate location (extend to other flows as needed). -->
-
- <!--
- <appender name="IDP_PASSWORD_AUDIT" class="ch.qos.logback.core.rolling.RollingFileAppender">
- <File>${idp.logfiles}/idp-password-audit.log</File>
-
- <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
- <fileNamePattern>${idp.logfiles}/idp-password-audit-%d{yyyy-MM-dd}.log.gz</fileNamePattern>
- <maxHistory>${idp.loghistory}</maxHistory>
- </rollingPolicy>
-
- <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
- <charset>UTF-8</charset>
- <Pattern>%msg%n</Pattern>
- </encoder>
- </appender>
-
- <logger name="Shibboleth-Audit.Password" level="ALL" additivity="false">
- <appender-ref ref="IDP_PASSWORD_AUDIT"/>
- </logger>
- -->
-
-</configuration>
diff --git a/idp-core/pom.xml b/idp-core/pom.xml
index 624b3f13c..611d57632 100644
--- a/idp-core/pom.xml
+++ b/idp-core/pom.xml
@@ -47,6 +47,18 @@
<groupId>io.dropwizard.metrics</groupId>
<artifactId>metrics-core</artifactId>
</dependency>
+
+ <!-- Added to support inclusion of a logback Evaluator. -->
+ <dependency>
+ <groupId>ch.qos.logback</groupId>
+ <artifactId>logback-classic</artifactId>
+ <scope>compile</scope>
+ </dependency>
+ <dependency>
+ <groupId>ch.qos.logback</groupId>
+ <artifactId>logback-core</artifactId>
+ <scope>compile</scope>
+ </dependency>
<!-- Provided Dependencies -->
diff --git a/idp-core/src/main/java/net/shibboleth/idp/logging/LogbackEvaluator.java b/idp-core/src/main/java/net/shibboleth/idp/logging/LogbackEvaluator.java
new file mode 100644
index 000000000..292cee3b1
--- /dev/null
+++ b/idp-core/src/main/java/net/shibboleth/idp/logging/LogbackEvaluator.java
@@ -0,0 +1,79 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.logging;
+
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.boolex.EvaluationException;
+import ch.qos.logback.core.boolex.EventEvaluatorBase;
+
+import java.util.regex.Pattern;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+/**
+ * Port of contributed logback Evaluator for log filtering replacing the
+ * Janino-based feature removed from logback for "reasons".
+ */
+public class LogbackEvaluator extends EventEvaluatorBase<ILoggingEvent> {
+
+ /** Filter against logger name/category. */
+ @Nullable private Pattern loggerPattern;
+
+ /** Filter against message. */
+ @Nullable private Pattern messagePattern;
+
+ /**
+ * Sets the regular expression pattern to match against the logging name/category.
+ *
+ * @param pattern pattern string to compile
+ */
+ public void setLoggerPattern(@Nonnull final String pattern) {
+ loggerPattern = Pattern.compile(pattern);
+ }
+
+ /**
+ * Sets the regular expression pattern to match against the logging message.
+ *
+ * @param pattern pattern string to compile
+ */
+ public void setMessagePattern(@Nonnull final String pattern) {
+ messagePattern = Pattern.compile(pattern);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean evaluate(final ILoggingEvent event) throws NullPointerException, EvaluationException {
+
+ // Shouldn't happen?
+ if (event == null) {
+ return true;
+ }
+
+ // If logger doesn't match, we're false.
+ if (loggerPattern != null && !loggerPattern.matcher(event.getLoggerName()).find()) {
+ return false;
+ }
+
+ // If message doesn't match, we're false.
+ if (messagePattern != null && !messagePattern.matcher(event.getFormattedMessage()).find()) {
+ return false;
+ }
+
+ // If both patterns are null, we don't match, otherwise we must have matched anything set.
+ return loggerPattern != null || messagePattern != null;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-core/src/main/java/net/shibboleth/idp/logging/package-info.java b/idp-core/src/main/java/net/shibboleth/idp/logging/package-info.java
new file mode 100644
index 000000000..07e551a2f
--- /dev/null
+++ b/idp-core/src/main/java/net/shibboleth/idp/logging/package-info.java
@@ -0,0 +1,18 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Logging utility classes.
+ */
+package net.shibboleth.idp.logging;
\ No newline at end of file
diff --git a/idp-war-distribution/pom.xml b/idp-war-distribution/pom.xml
index 0ae7664ea..566987bd8 100644
--- a/idp-war-distribution/pom.xml
+++ b/idp-war-distribution/pom.xml
@@ -25,17 +25,6 @@
<type>war</type>
<scope>runtime</scope>
</dependency>
- <!-- JPAR-57 - Logging -->
- <dependency>
- <groupId>ch.qos.logback</groupId>
- <artifactId>logback-classic</artifactId>
- <scope>runtime</scope>
- </dependency>
- <dependency>
- <groupId>ch.qos.logback</groupId>
- <artifactId>logback-core</artifactId>
- <scope>runtime</scope>
- </dependency>
<!-- Logging bridges for third-party extensions. -->
<dependency>
<groupId>${slf4j.groupId}</groupId>
@@ -49,12 +38,6 @@
<version>${slf4j.version}</version>
<scope>runtime</scope>
</dependency>
- <!-- Support for logback evaluator filter. -->
- <dependency>
- <groupId>org.codehaus.janino</groupId>
- <artifactId>janino</artifactId>
- <scope>runtime</scope>
- </dependency>
<!-- IDP-1205 - Support for JVM metrics -->
<dependency>
<groupId>io.dropwizard.metrics</groupId>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list