IDP 2.3.6 Stops Sending SAML Responses.

[Montoya,Jose T]

>Scott Wrote: Are you suggesting logging the fact that it's about to log? I hope not.
Well, no that's not what I was suggesting. But a log sync can be implemented that
Does not require a file or a remote server, but just a client. Some applications implement a client
Which attaches to the service and displays the log. The logger would not depend on something capturing the information therefore causing the hang up. It would just happily log to this sync hoping someone would attach and view it. It would be more for debugging rather than for compliance reasons. Maybe this kind of logging option would have been able to indicate that there was a problem with sending responses due to logging issues.

At this point, I'm just glad it's working. :)

I'll investigate your suggestions on logging locally.

Thank you.
-jose



-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, May 02, 2012 12:21 PM
To: Shib Users
Subject: Re: IDP 2.3.6 Stops Sending SAML Responses.

On 5/2/12 12:51 PM, "Montoya,Jose T" <jtmontoya at mdanderson.org> wrote:
>
>I would like for this issue to be considered a bug for the following
>reasons:

It is a bug, but the bug is with logback, not the IdP. I also don't think
it's good practice to remote syslog. I thought the usual idea was local
syslog, with syslog itself configured to relay the events, which takes
care of the async requirement. If not, then I'd say syslog is not
appropriate here. (Which in fact I think it's not, but that's a different
argument, and is subjective.)

>1. The IDP did not provide an obviously visible indicator that there was
>a logging problem.

If logging hangs, it seems to be impossible to provide such an indicator.
Are you suggesting logging the fact that it's about to log? I hope not.

>2. I'm not sure how strict the logging requirement is, but is it so
>strict that a failure to log a response should stop the idp from working?

I don't think logging justifies spinning up a thread to do the work, no.
Not everything can be implemented asynchronously. So yes, what happened is
what I would expect would happen (speaking as a deployer).

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net