security logging

[Russell Beall]

Thanks for the advice on this.  I took a fresh look at the situation and then found a perfect place to trigger the log event.

I'm subclassing UsernamePasswordLoginServlet anyway to create my own custom login handler, and I found that the service method will be run through to the end in both cases.  So now I pull the information I need for the log and then just use the loginFailed request attribute to tell me whether it was a success or failure.

Prior to noticing that, I thought that success went one way through the code and failures went a completely different way, but the overall function call still has to complete at some point...

Thanks,
Russ.

On Apr 8, 2013, at 6:06 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

> On 4/8/13 7:59 PM, "Russell Beall" <beall at usc.edu> wrote:
>> 
>> My question is: is there one place where I can add this code, or do I
>> have to write a post-login filter for the success line, and put the
>> failure line in the login handler (I believe it will have to go in the
>> login.jsp file since that code already understands the authentication
>> failed caseŠ)?
> 
> I think it's probably login handler dependent. Success can be inferred
> from the existing audit log, really, and failure will depend on what's
> going on in the login handler. It depends how much information you'd want
> about the failure too, but even generically it's going to be different in
> each case.
> 
>> I find it likely that others have had to do something similar, so, does
>> anybody have a path to this kind of thing that worked well for you?
> 
> I log from inside the code I have that's similar to the UserPass servlet
> mostly for failures.
> 
> I don't have anything that's normalizing success and failure into one type
> of log entry.
> 
> I don't know if you have any logging at a lower layer when the logins
> fail, but one thing you can do is operate at the logback end and write
> something there that would translate or act on specific log messages.
> 
> -- Scott
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>