[Shib-Users] Idp not posting saml response back to SP

[Cantor, Scott E.]

On 8/5/11 2:04 PM, "Roy, Nicholas S" <nicholas-roy at uiowa.edu> wrote:

>We are in the middle of an IdP upgrade to version 2.3.3, and this issue
>started showing up in our logs after the update.  It does appear to be
>related (as Scott's said) to invalid authentication on the part of a user
>attempting to log in.  My concern with this is that the entire stack
>trace gets logged in the IdP logs, which presents a pretty distinct path
>to a denial of service attack on the part of an attacker.  If you want to
>DoS the IdP service for someone, you just do a bunch of invalid authN
>attempts and fill up their disk with log files.  Would it be possible to
>handle this issue as a WARN and not log the entire stack trace?

It's pointless to look at individual messages and fix it this way, the
user can trigger a dozen or more long, ugly messages through ordinary
mistakes.

You can fix all this with logging config and filtering to tailor it to
your needs. It only logs the stack trace if you tell it to, for example.
First thing I did when I finished basic dev and testing work was to dig
into logback and learn how to customize my logs.

-- Scott