Where to define audit override beans?

[Christopher Bongaarts]

On 4/23/2024 7:32 AM, Cantor, Scott wrote:
>> <bean id="shibboleth.authn.Password.AuditExtractors"
>> parent="shibboleth.authn.Password.DefaultAuditExtractors" lazy-init="true">
>> [...]
> The quick answer is that the password audit log beans have to be in password-authn-config.xml
>
> The SAML and CAS auditing beans are defined in the global root context, but the login flow beans are defined in the webflow context.

Thanks for the explantion - it was helpful to understand where all these 
beans really belong.

I have two more issues to resolve to clean up my invasive mods.

1. The audit field %AR yields "Success" on success and the Spring event 
on failure.  This is what I'd want going forward, but for "backwards 
compatibility" I'd like to map those values into text strings:   
"Success" => "ok", all others => "failed".  I can work around this by 
defining my own custom field extraction that looks at the 
AuthenticationContext -> AuditContext and checks for the absence of an 
AuthenticationErrorContext; if it is present then return "failed" else "ok".

I can't grab the AR field because it doesn't exist at that point yet 
(AbstractAuditingValidationAction#doAudit creates and populates the 
AuditContext first, which runs my extractor, before it creates the magic 
AR field.  Having access to the "success" parameter passed to doAudit 
from within the extractor would be handy for this purpose.   I do wonder 
if there's an easier way I'm not seeing (my attempt to use the 
replacement map didn't work, but I'm not sure how to say "all spring 
events" there anyway).

2.  I'd like to make a custom log entry when SSO is performed (real Shib 
IdP SSO, not my legacy SSO from authn/External - the built-in 
authentication audit logging works fine for that case).  I want it to 
look like:
   sso ok for <username> on <ip> (<authncontext>) <sp>

I'm not sure if there's a way to do this (making the audit message as a 
whole conditional on whether we're doing SSO or not).  I still want the 
"regular" audit message (Shibboleth-Audit.SSO) in all cases, I just want 
one for when SSO is used.  I'm not super concerned about the 
authncontext being represented - there should always be a  previous 
audit message from when they actually logged in the first time with that.

My old (bad) way hacks the system authn-flow to insert my audit logging 
action before the UpdateSessionWithAuthenticationResult step.

Any ideas for this one?

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%