Distinguishing SSO from login with initial auth (3.2.1)

[Cantor, Scott]

> For completeness, the goal is to get an audit log entry for each of the
> following cases:
> - user enters valid username/password on password form
> - user enters invalid username/password on password form

I very explicitly rejected that being auditable. It just doesn't fit the model and how the audit log gets handled.  Of course it can be logged, but the audit log record only gets written once per request and it's just too difficult to try and change that.

Obviously you can write your own log entries to the same category, but since the whole field concept is specific to the built-in logs they won't really align. I'd use a separate category and appender.

>  And the audit log seems to only
> be invoked for ultimately successful authentications.

That's because a failed form login never advances to a place where auditing gets done. It just sits there and the user gives up. That's why I don't think it's compatible with the audit log.

>  I'm pretty sure I could
> have worked around that by dropping a new field in the audit context, but i
> think it would have meant modifying yet another system bean.

Adding fields is fully supported without modifying any system files but it can't log failed logins unless authentication actually completes either way.

-- Scott