[Shib-Users] Idp not posting saml response back to SP

[Roy, Nicholas S]

Thanks Scott, we will take a look at customizing the logging.

Nick

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott E.
Sent: Friday, August 05, 2011 1:09 PM
To: users at shibboleth.net
Subject: Re: [Shib-Users] Idp not posting saml response back to SP

On 8/5/11 2:04 PM, "Roy, Nicholas S" <nicholas-roy at uiowa.edu> wrote:

>We are in the middle of an IdP upgrade to version 2.3.3, and this issue 
>started showing up in our logs after the update.  It does appear to be 
>related (as Scott's said) to invalid authentication on the part of a 
>user attempting to log in.  My concern with this is that the entire 
>stack trace gets logged in the IdP logs, which presents a pretty 
>distinct path to a denial of service attack on the part of an attacker.  
>If you want to DoS the IdP service for someone, you just do a bunch of 
>invalid authN attempts and fill up their disk with log files.  Would it 
>be possible to handle this issue as a WARN and not log the entire stack trace?

It's pointless to look at individual messages and fix it this way, the user can trigger a dozen or more long, ugly messages through ordinary mistakes.

You can fix all this with logging config and filtering to tailor it to your needs. It only logs the stack trace if you tell it to, for example.
First thing I did when I finished basic dev and testing work was to dig into logback and learn how to customize my logs.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net