IdP logging setting question

[Brent Putman]

On 5/20/13 8:12 PM, David Bantz wrote:
> Hoping someone can answer of the top their head what setting(s) for which logger(s) will let me see the IdP's SAML assertion with values of the released attributes.

For SAML 2, if encryption is to be done, you'll see the unencrypted
Assertion coming from the following class on level DEBUG:
edu.internet2.middleware.shibboleth.idp.profile.saml2.
AbstractSAML2ProfileHandler.  So any Logger category + level that
includes that will do it. 

If it's not to be encrypted, then you can see it from category
PROTOCOL_MESSAGE on DEBUG (contained in the whole Response).


>
> Below: the settings from my staging IdP where I'm setting new attribute resolution and release and would like to see the outbound assertion with (unencrypted) values of attributes.  With these settings I'm seeing only the names of the attributes, not the values (in a log entry headed [INFO: Shibboleth-Audit...]).


Looks like you have edu.internet2.middleware.shibboleth on DEBUG, so
that would do it for the encryption case (unless you're running a
relatively old version of the IdP).



>
> David Bantz
>
> ---
>
> <?xml version="1.0" encoding="UTF-8"?>
>
>     <!-- Logs IdP, but not OpenSAML, messages -->
>     <logger name="edu.internet2.middleware.shibboleth">
>         <!-- <level value="INFO" /> -->
>         <level value="DEBUG" />
>     </logger>
>
>