Audit logging to include IP address

[Walter Forbes Hoehn (wassa)]

You just need to reference the proper MDC key in logback.xml.  See the example below:

    <appender name="IDP_AUDIT" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <File>${idp.home}/logs/idp-audit.log</File>

        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
            <fileNamePattern>${idp.home}/logs/idp-audit.log.%d{yyyyMMdd}</fileNamePattern>
        </rollingPolicy>

        <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
            <charset>UTF-8</charset>
            <Pattern>%mdc{idp.remote_addr}|${HOSTNAME}|%msg%n</Pattern>
        </encoder>
    </appender>


-WFH


> On Nov 19, 2015, at 3:52 PM, Jeffrey Eaton <jeaton at cmu.edu> wrote:
> 
> 
> As part of my testing of the IDP v3, I'm trying to figure out a way to improve the logging of authentication successes and failures.  We're using the JAAS username/password validation.  I would like the IDP to log every attempt to validate a username/password, including the source IP address.  I can get a success/failure messages like:
> 
> 2015-11-19 08:10:09,719 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstJAAS:194] - Profile Action ValidateUsernamePasswordAgainstJAAS: Login by 'jeaton' succeeded
> 2015-11-19 09:41:34,795 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstJAAS:199] - Profile Action ValidateUsernamePasswordAgainstJAAS: Login by jeaton failed
> 
> but looking at the source, I don't see any way to include the IP address in there.  As an aside, it would also be nice if the failure message also single-quoted the username to be consistent (or if the success line did not).
> 
> In my current V2 service, I'm using the OSU stateless extension, which I had modified to include an extra log entry, but I'd rather not have to maintain custom code.   Can the IP address be added to those log entries? Is there a better solution here, maybe by injecting an extra class which runs after the authentication step and just logs the result?
> 
> Further ideally, the log entry would include the IDP session identifier, so that I could tie a given password validation action to the events in the idp-audit.log for that user every time they go to a new SP, but I don't know if that information would even be available at the point in the code where the log entry would be generated.
> 
> Any advice/suggestions here would be appreciated.
> 
> -jeaton
> 
> 
> 
> 
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net