Audit logging to include IP address

[Jeffrey Eaton]

As part of my testing of the IDP v3, I'm trying to figure out a way to improve the logging of authentication successes and failures.  We're using the JAAS username/password validation.  I would like the IDP to log every attempt to validate a username/password, including the source IP address.  I can get a success/failure messages like:

2015-11-19 08:10:09,719 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstJAAS:194] - Profile Action ValidateUsernamePasswordAgainstJAAS: Login by 'jeaton' succeeded
2015-11-19 09:41:34,795 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstJAAS:199] - Profile Action ValidateUsernamePasswordAgainstJAAS: Login by jeaton failed

but looking at the source, I don't see any way to include the IP address in there.  As an aside, it would also be nice if the failure message also single-quoted the username to be consistent (or if the success line did not).

In my current V2 service, I'm using the OSU stateless extension, which I had modified to include an extra log entry, but I'd rather not have to maintain custom code.   Can the IP address be added to those log entries? Is there a better solution here, maybe by injecting an extra class which runs after the authentication step and just logs the result?

Further ideally, the log entry would include the IDP session identifier, so that I could tie a given password validation action to the events in the idp-audit.log for that user every time they go to a new SP, but I don't know if that information would even be available at the point in the code where the log entry would be generated.

Any advice/suggestions here would be appreciated.

-jeaton