Default Audit Format and CAS Mappings

[Cantor, Scott]

On 12/16/15, 2:39 PM, "dev on behalf of Marvin Addison" <dev-bounces at shibboleth.net on behalf of marvin.addison at gmail.com> wrote:



>Speaking with my deployer hat on for a moment, we frequently want to be able to answer the following question by querying IdP logs: give me a list of all services accessed during an SSO session. That's very straightforward if the IdP session identifier is included in the audit entry, but that's not the default.

The default sucks, but I did leave it deliberately to maintain alignment with V2. I can be overruled on that, or we could create two default log appenders/formats, etc. I did not spend any time on "hey, what would a good default be" in favor of the old default.

The SP is the same. The transaction log there is embarassingly bad, but I didn't change it even after adding the more advanced options there.

> Of course I can change it locally but I'm wondering why it's not included by default; it seems hugely valuable as something to correlate against for a particular session.

Entirely because it wasn't there before and people had parsing tools.

>The dev issue here is that I may have chosen poor audit field mappings for the CAS protocol. I made the TGT, which is implemented as the IdP session ID, map to SAMLAuditFields.REQUEST_ID, in order to provide something to correlate on for the purposes of auditing. It also struck me as reasonably similar in purpose to the SAML request ID at the time, but now I'm second guessing that decision. My inclination at the moment is to remove that mapping since the IdP session is clearly available via %s. Thoughts?

Well, just pedantically, the reason I buried a lot of that stuff in SAMLAuditFields was to allow other protocols to repurpose the same fields if they wanted to, but they could do it explicitly by creating those constants in a protocol-specific API class.

But as far as what the right or wrong values might be, I don't have much insight. I don't know that it buys a lot to remove the mapping.

-- Scott