checking IdP's outbound SAML assertion

[Brent Putman]

On 9/20/12 6:27 PM, David Bantz wrote:
> I'd like to verify the attribute values in the SAML assertion sent to
> a newly integrated service.  We've set the logging level to DEBUG; the
> tail of the logs for a transaction indicates the correct attribute
> names we are intending to release
> (surname,givenName,bannerid,BBConnectFedID), but not the values of
> those attributes.
>
> This transaction does enable authentication to the service; but how
> can I confirm I'm sending the values I think I am (apart from the
> obvious 'ask the service owner to look' which I'm not doing for good
> reasons I won't bore you with)?


The PROTOCOL_MESSAGE logging category will contain the whole message
being sent back to the SP, including the Assertion. But of course if
you're doing SAML encryption that doesn't help much.  :-)

For that reason, the SAML 2 profile handler does log on DEBUG the
unencrypted Assertion before it encrypts it.  It would be earlier in the
logs than the snippet you posted.  If you want to grep, it will coming
from class ' edu.internet2.middleware.shibboleth.idp.profile.saml2.
AbstractSAML2ProfileHandler' and/or look for it after a line containing
" Assertion to be encrypted is:".

Also, this Assertion log output was added later, in IdP 2.3.0, so if you
don't have this in the logs, you must be running an older version.

--Brent