Audit logging to include IP address

[Jeffrey Eaton]

> On Nov 19, 2015, at 7:31 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
> On 11/19/15, 4:52 PM, "users on behalf of Jeffrey Eaton" <users-bounces at shibboleth.net on behalf of jeaton at cmu.edu> wrote:
> 
> 
>> 
>> Further ideally, the log entry would include the IDP session identifier, so that I could tie a given password validation action to the events in the idp-audit.log for that user every time they go to a new SP, but I don't know if that information would even be available at the point in the code where the log entry would be generated.
> 
> The diagnostic logging isn't really manipulatable, that's just code. Adding the IP address is already possible with any log entries. Anything else is a code change.
> 
> The audit logging, OTOH, is totally configurable. Specific logins are not an auditable event, however, only profile runs.


I may be confusing my terminology here, but isn’t ValidateUsernamePasswordAgainstJAAS a profile?  Therefore, would it be possible to log the result of that run?

If there’s really no way to get the IDP to log the username/IP (and any other relevant details) when an authentication is successful or not in the current code, can I somehow file that as a feature request?

-jeaton