Default Audit Format and CAS Mappings

[Marvin Addison]

Speaking with my deployer hat on for a moment, we frequently want to be
able to answer the following question by querying IdP logs: give me a list
of all services accessed during an SSO session. That's very straightforward
if the IdP session identifier is included in the audit entry, but that's
not the default. Of course I can change it locally but I'm wondering why
it's not included by default; it seems hugely valuable as something to
correlate against for a particular session.

The dev issue here is that I may have chosen poor audit field mappings for
the CAS protocol. I made the TGT, which is implemented as the IdP session
ID, map to SAMLAuditFields.REQUEST_ID, in order to provide something to
correlate on for the purposes of auditing. It also struck me as reasonably
similar in purpose to the SAML request ID at the time, but now I'm second
guessing that decision. My inclination at the moment is to remove that
mapping since the IdP session is clearly available via %s. Thoughts?

M
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20151216/7de5c0ec/attachment.html>