Logging from the Sun Kerberos package?

[Cantor, Scott]

On 1/16/13 4:54 PM, "Douglas E. Engert" <deengert at anl.gov> wrote:
>
>On an older test IDP-2.3.5, with:
>
>logging.xml:
>  <!-- Logs IdP, but not OpenSAML, messages -->
>  <logger name="edu.internet2.middleware.shibboleth" level="DEBUG"/>

Right, but you don't run DEBUG in production. It would be slightly more
practical to just enable it for the category involved but still adds noise.

>It looks like with a little extra code in:
>edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLog
>inServlet
>the JAAS exception could be processed as IOException, KrbException, or
>LDAP error
>and log the message as ERROR and rather then only showing it as DEBUG.

No, you'll see that all your exceptions there are LoginException. Nothing
else is exposed, that's the problem with JAAS. I had to build my own code
to process specific exception messages into different error types and to
separate my login.config back-ends into specific attempts, one at a time.

All of that might show up in V3 or V3+n, but it isn't going into a 2.4
update. If anybody wants that functionality now, I made my code available.

But I would be fine with adjusting the category that's logging those
errors so it's accessible.

-- Scott