<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0">
<base href="https://shibboleth.atlassian.net">
<title>Message Title</title>
</head>
<body class="jira" style="color: #333333; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.429">
<table id="background-table" cellpadding="0" cellspacing="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; background-color: #f5f5f5; border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0" bgcolor="#f5f5f5"> <!-- header here -->
<tbody>
<tr>
<td id="header-pattern-container" style="padding: 0; border-collapse: collapse; padding: 10px 20px">
<table id="header-pattern" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="header-avatar-image-container" valign="top" style="padding: 0; border-collapse: collapse; vertical-align: top; width: 32px; padding-right: 8px" width="32"> <img id="header-avatar-image" class="image_fix" src="https://secure.gravatar.com/avatar/0316dae1128c1bac2a50be6df06a2233?d=https%3A%2F%2Favatar-management--avatars.us-west-2.prod.public.atl-paas.net%2Finitials%2FHM-0.png" height="32" width="32" border="0" style="border-radius: 3px; vertical-align: top"> </td>
<td id="header-text-container" valign="middle" style="padding: 0; border-collapse: collapse; vertical-align: middle; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px"> <a class="user-hover" rel="557058:1614c4a5-c89e-4edc-9421-990bd6ea85fd" style="color:#3b73af;; color: #3b73af; text-decoration: none" id="email_557058:1614c4a5-c89e-4edc-9421-990bd6ea85fd" href="https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd"> Henri Mikkonen </a> <strong>commented</strong> on <a href="https://shibboleth.atlassian.net/browse/JOIDC-112?atlOrigin=eyJpIjoiZjA3YmQwM2M2MzBhNGU2ODg4MzdkMmRmZWIxOGY3N2MiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none"><img src="cid:jira-generated-image-avatar-f13f2bde-f6e1-45b4-a8cd-7e583ad00ce1" height="16" width="16" border="0" align="absmiddle" alt="New Feature"> JOIDC-112</a> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="email-content-container" style="padding: 0; border-collapse: collapse; padding: 0 20px">
<table id="email-content-table" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; border-spacing: 0; border-collapse: separate">
<tbody>
<tr> <!-- there needs to be content in the cell for it to render in some clients -->
<td class="email-content-rounded-top mobile-expand" style="padding: 0; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 15px; background-color: #ffffff; border-left: 1px solid #cccccc; border-top: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom: 0; border-top-right-radius: 5px; border-top-left-radius: 5px; height: 10px; line-height: 10px; padding: 0 15px 0 16px; mso-line-height-rule: exactly" height="10" bgcolor="#ffffff"> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff">
<table class="page-title-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td style="vertical-align: top;; padding: 0; border-collapse: collapse; padding-right: 5px; font-size: 20px; line-height: 30px; mso-line-height-rule: exactly" class="page-title-pattern-header-container"> <span class="page-title-pattern-header" style="font-family: Arial, sans-serif; padding: 0; font-size: 20px; line-height: 30px; mso-text-raise: 2px; mso-line-height-rule: exactly; vertical-align: middle"> <a href="https://shibboleth.atlassian.net/browse/JOIDC-112?atlOrigin=eyJpIjoiZjA3YmQwM2M2MzBhNGU2ODg4MzdkMmRmZWIxOGY3N2MiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none">Re: OP_OIDC_MESSAGES log appender to trace all the exchanged protocol messages</a> </span> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="text-paragraph-pattern-top" class="email-content-main mobile-expand comment-top-pattern" style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff; border-bottom: none; padding-bottom: 0" bgcolor="#ffffff">
<table class="text-paragraph-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 2px">
<tbody>
<tr>
<td class="text-paragraph-pattern-container mobile-resize-text " style="padding: 0; border-collapse: collapse; padding: 0 0 10px"> <p style="margin: 10px 0 0; margin-top: 0">It sounds doable to make the decoders in <tt>net.shibboleth.idp.plugin.oidc.op.oauth2.decoding.impl</tt> and <tt>net.shibboleth.idp.plugin.oidc.op.decoding.impl</tt> packages to exploit the <b>PROTOCOL_MESSAGE</b> appender. Also {{ net.shibboleth.idp.plugin.oidc.op.encoding.impl.NimbusResponseEncode }} r could use it for logging the outgoing messages.</p> <p style="margin: 10px 0 0">In addition to those, to be inline with SAML logging, we should probably log the unencrypted id_token and/or userinfo response too, if encryption is enabled?</p> <p style="margin: 10px 0 0">Currently the DEBUG level for the packages mentioned above produces the log entries as shown below: in addition to request message parameters, also the headers are shown. Do we want to log the headers in all cases, or should it be configurable? Actually both headers and parameters may contain client_secrets in plaintext, so should the contents be somehow configurable? Also, In some cases, it might not be desired to log full access/refresh token values.</p>
<div class="preformatted panel" style="border-width: 1px;; border: 1px solid #cccccc; background: #f5f5f5; font-size: 12px; line-height: 1.333; font-family: monospace; border: 1px solid #cccccc; -moz-border-radius: 3px; border-radius: 3px; margin: 9px 0">
<div class="preformattedContent panelContent" style="padding: 9px 12px">
<pre style="margin: 10px 0 0; margin-top: 0; max-height: 30em; overflow: auto; white-space: pre-wrap; word-wrap: normal; white-space: pre; word-break: normal; word-wrap: break-word; word-break: break-all; white-space: pre-wrap">2022-06-09 10:33:00,863 - xx.xx.xx.xx - DEBUG [net.shibboleth.idp.plugin.oidc.op.decoding.impl.OIDCAuthenticationRequestDecoder:49] - Inbound request GET
Headers:
Accept:[text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8]
Accept-Encoding:[gzip, deflate, br]
Accept-Language:[en-US,en;q=0.5]
Connection:[keep-alive]
Content-Type:[null]
Cookie:[JSESSIONID=node01u726jb50r2r100fwqa755vj30.node0; shib_idp_session=f855c9e09981478bc974ac1da5e77a6af506725a46c21ba9afd674702ad50339; _opensaml_req_ss%3Amem%3A68369ceb4f9f5d6604361df117b275ad8dc92f384a4ed91a1a25f77e50266725=_9bdf8b5df520cc3fec1c0c50b1caf844; mod_auth_openidc_state_PRMb1XTpvPWUZLf6Ic-44DrCqbk=1V0SVBm8EATdOo-gW3YP1YioyCrNZ6rDQwGpKP5nGuxdf9DrHjw5Ud8zlrvbg4_A40je3_9HQuAOUo-0zKW0YGsNqlxPVNOGcY8S16lYJJqCvuXXTpdQG4aif-DOenX1mrdAIKLOu-tGPkToi3WL4WtV8XW3PreziVrMd9h6VYdESjgR8pCZ8piuN8bwY4lIobXdo8y3iyGT0suHnIuLR8YZOkui3OCGuALIXHeq2tsjJRK5fizGM3uO5E1K4cvRIuhaAJqs7U8BPzo1DhROTa77DSd-rDQUe536zLdkkGy7Mwdewls45HeO1iMss6NU]
Host:[xx.xx.fi]
Sec-Fetch-Dest:[document]
Sec-Fetch-Mode:[navigate]
Sec-Fetch-Site:[none]
Sec-Fetch-User:[?1]
Upgrade-Insecure-Requests:[1]
User-Agent:[Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:101.0) Gecko/20100101 Firefox/101.0]
X-Forwarded-For:[yy.yy.yy.yy]
X-Forwarded-Host:[xx.xx.fi]
X-Forwarded-Proto:[https]
X-Forwarded-Server:[xx.xx.fi]
Parameters:
scope:openid profile email address phone offline_access
response_type:code
state:PRMb1XTpvPWUZLf6Ic-44DrCqbk
redirect_uri:https://xx.xx.fi/protected/redirect_uri
nonce:acTAMAGnm14YkY-7gnBBl8Jd5OEV-c0FJVcrXeFzymk
client_id:test_rp_saml
</pre>
</div>
</div> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff"> <script type="application/ld+json">
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"description": "View Issue",
"potentialAction": {
"@type": "ViewAction",
"target": "https://shibboleth.atlassian.net/browse/JOIDC-112?inbox=true&focusedCommentId=32885&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-32885",
"name": "View Comment"
},
"publisher": {
"@type": "Organization",
"name": "Atlassian",
"url": "https://www.atlassian.com"
}
}
</script>
<table id="actions-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px">
<tbody>
<tr>
<td id="actions-pattern-container" valign="middle" style="padding: 0; border-collapse: collapse; padding: 10px 0 10px 24px; vertical-align: middle; padding-left: 0">
<table align="left" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td class="actions-pattern-action-icon-container" style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 0; vertical-align: middle"> <a href="https://shibboleth.atlassian.net/browse/JOIDC-112#add-comment?atlOrigin=eyJpIjoiZjA3YmQwM2M2MzBhNGU2ODg4MzdkMmRmZWIxOGY3N2MiLCJwIjoiaiJ9" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none"> <img class="actions-pattern-action-icon-image" src="cid:jira-generated-image-static-comment-icon-327f8e12-0f6f-431e-8eef-cd4b2f5d9e68" alt="Add Comment" title="Add Comment" height="16" width="16" border="0" style="vertical-align: middle"> </a> </td>
<td class="actions-pattern-action-text-container" style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 4px; padding-left: 5px"> <a href="https://shibboleth.atlassian.net/browse/JOIDC-112#add-comment?atlOrigin=eyJpIjoiZjA3YmQwM2M2MzBhNGU2ODg4MzdkMmRmZWIxOGY3N2MiLCJwIjoiaiJ9" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none">Add Comment</a> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table> </td>
</tr> <!-- there needs to be content in the cell for it to render in some clients -->
<tr>
<td class="email-content-rounded-bottom mobile-expand" style="padding: 0; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 5px; line-height: 5px; background-color: #ffffff; border-top: 0; border-left: 1px solid #cccccc; border-bottom: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom-right-radius: 5px; border-bottom-left-radius: 5px; mso-line-height-rule: exactly" height="5" bgcolor="#ffffff"> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="footer-pattern" style="padding: 0; border-collapse: collapse; padding: 12px 20px">
<table id="footer-pattern-container" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="footer-pattern-mobile-separated-links" class="mobile-resize-text" width="100%" colspan="2" style="padding: 0; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px"> Get Jira notifications on your phone! Download the Jira Cloud app for <a href="https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail" style="color: #3b73af; text-decoration: none">Android</a> or <a href="https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8" style="color: #3b73af; text-decoration: none">iOS</a>
<hr> </td>
</tr>
<tr>
<td id="footer-pattern-text" class="mobile-resize-text" width="100%" style="padding: 0; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px"> This message was sent by Atlassian Jira <span id="footer-build-information">(v1001.0.0-SNAPSHOT#100200-<span title="91993055c559c982d116d2021e4718fea6f8f509" data-commit-id="91993055c559c982d116d2021e4718fea6f8f509}">sha1:9199305</span>)</span> </td>
<td id="footer-pattern-logo-desktop-container" valign="top" style="padding: 0; border-collapse: collapse; padding-left: 20px; vertical-align: top">
<table style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="footer-pattern-logo-desktop-padding" style="padding: 0; border-collapse: collapse; padding-top: 3px; opacity: 0.150"> <img id="footer-pattern-logo-desktop" src="cid:jira-generated-image-static-footer-desktop-logo-bb98972e-29ad-48ac-b352-ecabe25c6590" alt="Atlassian logo" title="Atlassian logo" width="192" height="24" class="image_fix"> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table>
</body>
</html>