idpv3 testing: clientIP in audit logs and consent jdbc ?

[Tom Zeller]

On Fri, Jan 30, 2015 at 12:09 PM, Brent Putman <putmanb at georgetown.edu> wrote:
>
> On 1/30/15 11:02 AM, Jarno Huuskonen wrote:
>> Is it possible to get clientIP address in audit logs ?
>> I didn't get (v2.4.3 <Pattern>%msg%mdc{clientIP}|%n</Pattern>) to
>> work (this appends clientIP string (not the address to audit logs).
>> (Editing audit.xml didn't work any better).
>
> Looks like the SLF4J MDC variable name we use here has just changed in
> v3.  Try "idp.remote_addr" instead of "clientIP".

Consent audit logging which writes to logs/idp-consent-audit.log is
defined in conf/intercept/consent-intercept-config.xml. To add logging
of the remote address, a "%a" needs to be added to the audit
formatting map :

    <util:map id="shibboleth.consent.attribute-release.AuditFormattingMap">
        <entry key="Shibboleth-Consent-Audit"
value="%T|%SP|%e|%u|%CCI|%CCV|%CCA|a" />
    </util:map>

However, there is a bug[1] which prevents this from working without
modifying files in system/.

The tokens (e.g. %a) are defined in
net.shibboleth.idp.profile.IdPAuditFields, but I do not think we
publish Javadoc anywhere for me to link to.

[1] https://issues.shibboleth.net/jira/browse/IDP-582