Running loganalysis.py against a V3 audit log

[Wessel, Keith]

Ah-ha. Thanks for setting me straight on those last two fields. So, in that case, sound slike the only problems are (1) the missing terminating pipe (which I can fake in by adding it to my pattern in logback.xml) and the change in the message profile name which my/Kevin's mods took care of.

At least that's all I've found so far.

Peter, would you like mt to log the message profile check for counting number of logins as a defect?

Scott, shall I log the missing terminating pipe char as a defect?

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, November 04, 2015 4:06 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Running loganalysis.py against a V3 audit log

On 11/4/15, 4:56 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:



>The difference is in the last few fields after the released attributes. The code in the script claims to be looking for the NaeID, the asserted IDs, then the end of the line. In my V3 audit log after the attributes released, I see a long string starting with AA and ending with == that I take to be the encrypted SAML response.

No, that's the NameID value.

> I then see one more field, a shorter string starting with an underscore followed by 32 hex digits which I assume is the transientID being used as the nameID.

No, that's the assertion ID. ;-)

> I could be wrong about both of these assumptions. There is, however, no trailing pipe character, and the script expects 14 fields each separated by a pipe, the last of which it just calls EOL. So, the whole problem could be the lack of a terminating pipe.

That could be. I wasn't aware, I thought they were delimiters only. That's easy enough to fix.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net