Logging from the Sun Kerberos package?

[Wessel, Keith William]

Thanks, Scott and Doug for all of this info.

Seems like it would make sense to ask Scott, when time permits, for him to allow one to configure these messages in logging.xml without putting any logging into debug mode.

Shall I just put this into Bugzilla as a feature request, Scott?

Keith


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, January 16, 2013 4:04 PM
To: Shib Users
Subject: Re: Logging from the Sun Kerberos package?

On 1/16/13 4:54 PM, "Douglas E. Engert" <deengert at anl.gov> wrote:
>
>On an older test IDP-2.3.5, with:
>
>logging.xml:
>  <!-- Logs IdP, but not OpenSAML, messages -->
>  <logger name="edu.internet2.middleware.shibboleth" level="DEBUG"/>

Right, but you don't run DEBUG in production. It would be slightly more
practical to just enable it for the category involved but still adds noise.

>It looks like with a little extra code in:
>edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLog
>inServlet
>the JAAS exception could be processed as IOException, KrbException, or
>LDAP error
>and log the message as ERROR and rather then only showing it as DEBUG.

No, you'll see that all your exceptions there are LoginException. Nothing
else is exposed, that's the problem with JAAS. I had to build my own code
to process specific exception messages into different error types and to
separate my login.config back-ends into specific attempts, one at a time.

All of that might show up in V3 or V3+n, but it isn't going into a 2.4
update. If anybody wants that functionality now, I made my code available.

But I would be fine with adjusting the category that's logging those
errors so it's accessible.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net