<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 12/6/2016 2:49 PM, Cantor, Scott
wrote:<br>
</div>
<blockquote
cite="mid:9846A6064BD102419D06814DD0D78DE112AC88BE@CIO-TNC-D2MBX02.osuad.osu.edu"
type="cite">
<blockquote type="cite" style="color: #000000;">
<pre wrap="">I expect this to be easier in 3.3 when we're able to ditch the initial
auth construct...
</pre>
</blockquote>
<pre wrap="">There's an API for this, and there're already success/failure counters.</pre>
</blockquote>
<br>
For completeness, the goal is to get an audit log entry for each of
the following cases:<br>
- user enters valid username/password on password form<br>
- user enters invalid username/password on password form<br>
- user auths with Duo 2nd factor (and maybe a fail counterpart if
detectable)<br>
- user is considered authed by virtue of SSO (either password or
Duo)'<br>
This would be in addition to the standard audit log entries.<br>
<br>
General format of log messages is:<br>
login ok for USERNAME on CLIENTIP (AUTHNCONTEXTCLASSREF) SPENTITYID<br>
login failed for USERNAME on CLIENTIP () SPENTITYID<br>
sso ok for USERNAME on CLIENTIP (AUTHNCONTEXTCLASSREF) SPENTITYID<br>
<br>
The first two I had to insert directly in
ValdiateUsernamePasswordWithLDAP (actually my lockout derivative) in
order to catch that particular case, particularly failure.<br>
<br>
In fact, if I didn't care about differentiating between SSO and
entering user/pass, I was *almost* able to get the stock audit log
configured to output these; I forget which item was not immediately
available - think it was the relying party entity ID or the authn
context. And the audit log seems to only be invoked for ultimately
successful authentications. I'm pretty sure I could have worked
around that by dropping a new field in the audit context, but i
think it would have meant modifying yet another system bean. <br>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>