Removing/fixing shibboleth stats in Apache logs

[Brent Putman]

On 9/17/12 9:32 PM, Roland Tanner wrote:
> The 
> "https://idp.university.ac.uk/shibboleth!https://some.resource.com/shibboleth-sp!p610nflqaikrki6sodm43hb36" 
> is the 'login name', 

I believe what you are seeing is the SP using its default precedence
list to make a SAML attribute value or NameID get set as REMOTE_USER,
which has special meaning to Apache.


> Is there a quick way to stop shibd adding logs to Apache's logs, or is 
> that something that needs to be handled through the Apache config?


You can change the precedence list for what it treats as REMOTE_USER on
the ApplicationDefaults element in shibboleth2.xml:

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplication

You can set it to an attribute (or list of candidate attributes) that
will look more like a "user name").  Or alternatively, if you aren't
using REMOTE_USER in your app, then just try setting it to the empty
list.  That will presumably cause it to not set any REMOTE_USER at all -
although I haven't tried it.