Logging from the Sun Kerberos package?

[Douglas E. Engert]

On 1/16/2013 4:03 PM, Cantor, Scott wrote:
> On 1/16/13 4:54 PM, "Douglas E. Engert" <deengert at anl.gov> wrote:
>>
>> On an older test IDP-2.3.5, with:
>>
>> logging.xml:
>>   <!-- Logs IdP, but not OpenSAML, messages -->
>>   <logger name="edu.internet2.middleware.shibboleth" level="DEBUG"/>
>
> Right, but you don't run DEBUG in production. It would be slightly more
> practical to just enable it for the category involved but still adds noise.
>
>> It looks like with a little extra code in:
>> edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLog
>> inServlet
>> the JAAS exception could be processed as IOException, KrbException, or
>> LDAP error
>> and log the message as ERROR and rather then only showing it as DEBUG.
>
> No, you'll see that all your exceptions there are LoginException.

I thought that the Answer 1 in this:
http://stackoverflow.com/questions/9738756/jaas-kerberos-login-exception-on-wrong-username-password

showed how to get the underlying exception:
  Throwable t = e.getCause();
  if (t instanceof KrbException) {
And from there one could get
  the error message from the t.getMessage();

> Nothing
> else is exposed, that's the problem with JAAS. I had to build my own code
> to process specific exception messages into different error types and to
> separate my login.config back-ends into specific attempts, one at a time.
>
> All of that might show up in V3 or V3+n, but it isn't going into a 2.4
> update. If anybody wants that functionality now, I made my code available.
>
> But I would be fine with adjusting the category that's logging those
> errors so it's accessible.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
>

-- 

  Douglas E. Engert  <DEEngert at anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444