Audit logging to include IP address

[Jeffrey Eaton]

Thanks, that’s very helpful.

I was looking at the options for editing audit.xml on https://wiki.shibboleth.net/confluence/display/IDP30/AuditLoggingConfiguration  
I see now that the MDC options are documented on https://wiki.shibboleth.net/confluence/display/IDP30/LoggingConfiguration

So now I can get an audit entry containing the client IP for every SSO event, which is great.  

 I’d still like to be able to get a discrete log entry whenever someone enters their password and it is successfully validated.  As far as I can tell, there’s no fields available in the audit log indicating such, nor is there any other way to generate a new/different log entry whenever the password is validated (or fails).

-jeaton

> On Nov 19, 2015, at 4:59 PM, Walter Forbes Hoehn (wassa) <wassa at memphis.edu> wrote:
> 
> You just need to reference the proper MDC key in logback.xml.  See the example below:
> 
>    <appender name="IDP_AUDIT" class="ch.qos.logback.core.rolling.RollingFileAppender">
>        <File>${idp.home}/logs/idp-audit.log</File>
> 
>        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
>            <fileNamePattern>${idp.home}/logs/idp-audit.log.%d{yyyyMMdd}</fileNamePattern>
>        </rollingPolicy>
> 
>        <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
>            <charset>UTF-8</charset>
>            <Pattern>%mdc{idp.remote_addr}|${HOSTNAME}|%msg%n</Pattern>
>        </encoder>
>    </appender>
> 
> 
> -WFH
> 
> 
>> On Nov 19, 2015, at 3:52 PM, Jeffrey Eaton <jeaton at cmu.edu> wrote:
>> 
>> 
>> As part of my testing of the IDP v3, I'm trying to figure out a way to improve the logging of authentication successes and failures.  We're using the JAAS username/password validation.  I would like the IDP to log every attempt to validate a username/password, including the source IP address.  I can get a success/failure messages like:
>> 
>> 2015-11-19 08:10:09,719 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstJAAS:194] - Profile Action ValidateUsernamePasswordAgainstJAAS: Login by 'jeaton' succeeded
>> 2015-11-19 09:41:34,795 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstJAAS:199] - Profile Action ValidateUsernamePasswordAgainstJAAS: Login by jeaton failed
>> 
>> but looking at the source, I don't see any way to include the IP address in there.  As an aside, it would also be nice if the failure message also single-quoted the username to be consistent (or if the success line did not).
>> 
>> In my current V2 service, I'm using the OSU stateless extension, which I had modified to include an extra log entry, but I'd rather not have to maintain custom code.   Can the IP address be added to those log entries? Is there a better solution here, maybe by injecting an extra class which runs after the authentication step and just logs the result?
>> 
>> Further ideally, the log entry would include the IDP session identifier, so that I could tie a given password validation action to the events in the idp-audit.log for that user every time they go to a new SP, but I don't know if that information would even be available at the point in the code where the log entry would be generated.
>> 
>> Any advice/suggestions here would be appreciated.
>> 
>> -jeaton
>> 
>> 
>> 
>> 
>> 
>> -- 
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net