Running loganalysis.py against a V3 audit log

[Cantor, Scott]

On 11/4/15, 4:56 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:



>The difference is in the last few fields after the released attributes. The code in the script claims to be looking for the NaeID, the asserted IDs, then the end of the line. In my V3 audit log after the attributes released, I see a long string starting with AA and ending with == that I take to be the encrypted SAML response.

No, that's the NameID value.

> I then see one more field, a shorter string starting with an underscore followed by 32 hex digits which I assume is the transientID being used as the nameID.

No, that's the assertion ID. ;-)

> I could be wrong about both of these assumptions. There is, however, no trailing pipe character, and the script expects 14 fields each separated by a pipe, the last of which it just calls EOL. So, the whole problem could be the lack of a terminating pipe.

That could be. I wasn't aware, I thought they were delimiters only. That's easy enough to fix.

-- Scott