Logging from the Sun Kerberos package?

[Cantor, Scott]

On 1/15/13 10:40 PM, "Wessel, Keith William" <kwessel at illinois.edu> wrote:

>I¹m already aware that JAAS doesn¹t contain any useful logging that log4j
>can capture and log.

We don't use log4j, we use slf4j over logback.

> Was wondering if, going to the Kerberos level, we could obtain any use
>log message, though. We¹re using Kerberos with the UserPassword login
>handler, and when someone has a successful or unsuccessful login, it¹d be
>nice to get some logging as suchŠ especially with unsuccessful login
>attempts.

I don't get anything inside the IdP, which is why I wrote my own login
handler to run the JAAS API myself and pick up the exceptions so I could
log them. When I use it for basic auth for ECP outside the IdP, I used
Jetty to route everything it was getting to a jetty log and I get all the
exception traces there.

> 
>If anyone¹s accomplished this, if they could share what package they¹ve
>added to their logging.xml, I¹d appreciate it. I¹ve tried various
>permutations of the Sun Kerberos auth package, unsure of how much of the
>actual package name needs to be included, and I¹ve had no success getting
>anything of interest in the log. It either means there¹s nothing being
>logged or I just didn¹t choose the right option.

The Kerberos module itself doesn't log anything to my knowledge. It's up
to the surrounding code. Jetty's container auth code that calls JAAS does
this by catching the LoginException and dumping the stack trace, which
reaches into the Kerberos code.

The IdP, I think, swallows that exception, but I haven't run the stock
code in a while. Looking at the code:

if (authnException != null) {
	LOG.debug("Exception returned from login handler for authentication
method {}:\n{}",
	loginContext.getAttemptedAuthnMethod(), authnException);

Basically it seems to be logging it on debug. If you file a RFE, I can
maybe fix that log to a dedicated category. I think it was viewed as not
ideal to just log that as an error or whatever, since obviously the log
would be riddled with user password errors, but OTOH most of us with large
deploys kind of need that data for forensics.


-- Scott