Audit logging to include IP address

[Walter Forbes Hoehn (wassa)]

There is an INFO level message in the process log.

-WFH


> On Nov 23, 2015, at 10:29 PM, Jeffrey Eaton <jeaton at cmu.edu> wrote:
> 
> Thanks, that’s very helpful.
> 
> I was looking at the options for editing audit.xml on https://wiki.shibboleth.net/confluence/display/IDP30/AuditLoggingConfiguration  
> I see now that the MDC options are documented on https://wiki.shibboleth.net/confluence/display/IDP30/LoggingConfiguration
> 
> So now I can get an audit entry containing the client IP for every SSO event, which is great.  
> 
> I’d still like to be able to get a discrete log entry whenever someone enters their password and it is successfully validated.  As far as I can tell, there’s no fields available in the audit log indicating such, nor is there any other way to generate a new/different log entry whenever the password is validated (or fails).
> 
> -jeaton
> 
>> On Nov 19, 2015, at 4:59 PM, Walter Forbes Hoehn (wassa) <wassa at memphis.edu> wrote:
>> 
>> You just need to reference the proper MDC key in logback.xml.  See the example below:
>> 
>>   <appender name="IDP_AUDIT" class="ch.qos.logback.core.rolling.RollingFileAppender">
>>       <File>${idp.home}/logs/idp-audit.log</File>
>> 
>>       <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
>>           <fileNamePattern>${idp.home}/logs/idp-audit.log.%d{yyyyMMdd}</fileNamePattern>
>>       </rollingPolicy>
>> 
>>       <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
>>           <charset>UTF-8</charset>
>>           <Pattern>%mdc{idp.remote_addr}|${HOSTNAME}|%msg%n</Pattern>
>>       </encoder>
>>   </appender>
>> 
>> 
>> -WFH
>> 
>> 
>>> On Nov 19, 2015, at 3:52 PM, Jeffrey Eaton <jeaton at cmu.edu> wrote:
>>> 
>>> 
>>> As part of my testing of the IDP v3, I'm trying to figure out a way to improve the logging of authentication successes and failures.  We're using the JAAS username/password validation.  I would like the IDP to log every attempt to validate a username/password, including the source IP address.  I can get a success/failure messages like:
>>> 
>>> 2015-11-19 08:10:09,719 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstJAAS:194] - Profile Action ValidateUsernamePasswordAgainstJAAS: Login by 'jeaton' succeeded
>>> 2015-11-19 09:41:34,795 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstJAAS:199] - Profile Action ValidateUsernamePasswordAgainstJAAS: Login by jeaton failed
>>> 
>>> but looking at the source, I don't see any way to include the IP address in there.  As an aside, it would also be nice if the failure message also single-quoted the username to be consistent (or if the success line did not).
>>> 
>>> In my current V2 service, I'm using the OSU stateless extension, which I had modified to include an extra log entry, but I'd rather not have to maintain custom code.   Can the IP address be added to those log entries? Is there a better solution here, maybe by injecting an extra class which runs after the authentication step and just logs the result?
>>> 
>>> Further ideally, the log entry would include the IDP session identifier, so that I could tie a given password validation action to the events in the idp-audit.log for that user every time they go to a new SP, but I don't know if that information would even be available at the point in the code where the log entry would be generated.
>>> 
>>> Any advice/suggestions here would be appreciated.
>>> 
>>> -jeaton
>>> 
>>> 
>>> 
>>> 
>>> 
>>> -- 
>>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>> 
>> -- 
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net