Native F-TICKS logging could be in Shibboleth v3 with your support..

[Chris Phillips]

Hi all,

As part of my work with the Canadian Access Federation that CANARIE operates, I have implemented native support for F-TICKS[1] logging for Shibboleth V3 and have opened a feature enhancement ticket to suggest it be part of the Shibboleth distribution so others may be able to benefit from it's inclusion in the distro:

https://issues.shibboleth.net/jira/browse/IDP-840 <https://issues.shibboleth.net/jira/browse/IDP-840>

One aspect that is hard to describe for the ticket (beyond my observations) is interest in such a feature being in the core.

As it is not a code update, but a configuration, it's not a big change, but is a change nonetheless.  I have already described a few aspects of the use of F-TICKS in the ticket but if I have missed your federation or site use of the extra logging format, please voice your support either in the ticket or on the users list.  By doing so I hope the request will have more information than just my observations on what it would mean to include it in the Shibboleth distro in a useful and sustainable fashion that would benefit the most users of the IdP software.

Many thanks to those who helped out on this and for the Shibboleth team to have a framework in v3 that made this much easier  to accomplish all without coding.

For those who need a bit more background on F-TICKS keep scrolling to see more detail..

Thanks!

Chris
___________________________________________________________________________________________
Chris Phillips
Technical Architect, Canadian Access Federation | CANARIE| chris.phillips at canarie.ca <mailto:chris.phillips at canarie.ca> |GPG: 0x0380811D



What is F-TICKS?
F-TICKS[1] is a log format that masks user identifying sign in information to allow for statistical collection of access logs while protecting personally identifiable information.  While F-TICKS is used widely in eduroam[2], other higher education federations also use it in the SAML space.

Having F-TICKS support in Shibboleth v2.x was slightly tedious and had more dependancies than desired but is a key operational aspect to assist with logging and deriving access metrics in the federated sign on space.  The difficulty to implement on v2 prevented more widespread adoption  of the technique.

In Shibboleth v3 it was much easier to refactor it into the logging infrastructure and leverage the bean support to accomplish the same thing with no external dependancies. (hurray!)  Having this available to any Idp operator I think would be very beneficial and allow tools like the UK's Raptor[3], SWAMID's FLOG tools[4] to work more seamlessly than before and potentially simplify deployments.

[1] https://tools.ietf.org/html/draft-johansson-fticks-00 <https://tools.ietf.org/html/draft-johansson-fticks-00>
[2] https://monitor.eduroam.org/f-ticks/ <https://monitor.eduroam.org/f-ticks/>
[3] http://iam.cf.ac.uk/trac/RAPTOR <http://iam.cf.ac.uk/trac/RAPTOR>
[4] https://github.com/SUNET/flog <https://github.com/SUNET/flog>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151023/5fd59ea7/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 841 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://shibboleth.net/pipermail/users/attachments/20151023/5fd59ea7/attachment-0001.sig>