security logging

[Russell Beall]

Hi,

I have a request to create a log line that can be parsed similar to the way system-level authentication messages go to /var/log/auth.

The referring website is needed (or maybe just the entityID), source IP, username, and authentication success/failure.

My question is: is there one place where I can add this code, or do I have to write a post-login filter for the success line, and put the failure line in the login handler (I believe it will have to go in the login.jsp file since that code already understands the authentication failed case…)?

I find it likely that others have had to do something similar, so, does anybody have a path to this kind of thing that worked well for you?

Thanks,
Russ.