Log SOAP Binding Credential

[Brent Putman]

Just getting to some backlog of list mail...



On 1/23/14 2:31 PM, Marvin Addison wrote:
> Is there a logger I can turn up to log the PEM-encoded certificate
> that the container provides to the IdP when terminating a SOAP binding
> request?

Hi Marvin,
I know you already solved your underlying problem, but for the archives:

Yes, in the v2 IdP and OpenSAML the following class is the
SecurityPolicyRule that implements client TLS authentication.  On DEBUG
it will log the Base64-encoded cert that is being presented.

org.opensaml.ws.security.provider.ClientCertAuthRule

Additionally, prior to that, on INFO it explicitly logs if no client TLS
cert was present (meaning, made available from the container). With
respect to what turned out to be your problem, this would have been a
hint as to what was going on.

--Brent