security logging

[Cantor, Scott]

On 4/8/13 7:59 PM, "Russell Beall" <beall at usc.edu> wrote:
>
>My question is: is there one place where I can add this code, or do I
>have to write a post-login filter for the success line, and put the
>failure line in the login handler (I believe it will have to go in the
>login.jsp file since that code already understands the authentication
>failed caseŠ)?

I think it's probably login handler dependent. Success can be inferred
from the existing audit log, really, and failure will depend on what's
going on in the login handler. It depends how much information you'd want
about the failure too, but even generically it's going to be different in
each case.

>I find it likely that others have had to do something similar, so, does
>anybody have a path to this kind of thing that worked well for you?

I log from inside the code I have that's similar to the UserPass servlet
mostly for failures.

I don't have anything that's normalizing success and failure into one type
of log entry.

I don't know if you have any logging at a lower layer when the logins
fail, but one thing you can do is operate at the logback end and write
something there that would translate or act on specific log messages.

-- Scott