Native F-TICKS logging could be in Shibboleth v3 with your support..

[Simon Lundström]

Hi Chris!

Would be nice to have the configuration in by default. We are quite
heavy users of it, since we are part of SWAMID.

Right now the version in the examples (and the IDP deployer) the version
is 1.0 in the protocol. In the SWAMID docs and our (and I'm guessing
others too) IDP the version is set to 2.0. IIRC the 1.0 version is used
by eduroam. Maybe this could be corrected?

The usage statistics is nice to have as leverage and gives incentive to
federate more services.

BR,
- Simon

____________________________________

Simon Lundström
Section for Infrastructure

IT Services
Stockholm University
SE-106 91 Stockholm, Sweden

www.su.se/english/staff-info/it

On Fri, 2015-10-23 at 15:02:10 +0000, Chris Phillips wrote:
> Hi all,
> 
> As part of my work with the Canadian Access Federation that CANARIE operates, I have implemented native support for F-TICKS[1] logging for Shibboleth V3 and have opened a feature enhancement ticket to suggest it be part of the Shibboleth distribution so others may be able to benefit from it's inclusion in the distro:
> 
> https://issues.shibboleth.net/jira/browse/IDP-840 <https://issues.shibboleth.net/jira/browse/IDP-840>
> 
> One aspect that is hard to describe for the ticket (beyond my observations) is interest in such a feature being in the core.
> 
> As it is not a code update, but a configuration, it's not a big change, but is a change nonetheless.  I have already described a few aspects of the use of F-TICKS in the ticket but if I have missed your federation or site use of the extra logging format, please voice your support either in the ticket or on the users list.  By doing so I hope the request will have more information than just my observations on what it would mean to include it in the Shibboleth distro in a useful and sustainable fashion that would benefit the most users of the IdP software.
> 
> Many thanks to those who helped out on this and for the Shibboleth team to have a framework in v3 that made this much easier  to accomplish all without coding.
> 
> For those who need a bit more background on F-TICKS keep scrolling to see more detail..
> 
> Thanks!
> 
> Chris
> ___________________________________________________________________________________________
> Chris Phillips
> Technical Architect, Canadian Access Federation | CANARIE| chris.phillips at canarie.ca <mailto:chris.phillips at canarie.ca> |GPG: 0x0380811D
> 
> 
> 
> What is F-TICKS?
> F-TICKS[1] is a log format that masks user identifying sign in information to allow for statistical collection of access logs while protecting personally identifiable information.  While F-TICKS is used widely in eduroam[2], other higher education federations also use it in the SAML space.
> 
> Having F-TICKS support in Shibboleth v2.x was slightly tedious and had more dependancies than desired but is a key operational aspect to assist with logging and deriving access metrics in the federated sign on space.  The difficulty to implement on v2 prevented more widespread adoption  of the technique.
> 
> In Shibboleth v3 it was much easier to refactor it into the logging infrastructure and leverage the bean support to accomplish the same thing with no external dependancies. (hurray!)  Having this available to any Idp operator I think would be very beneficial and allow tools like the UK's Raptor[3], SWAMID's FLOG tools[4] to work more seamlessly than before and potentially simplify deployments.
> 
> [1] https://tools.ietf.org/html/draft-johansson-fticks-00 <https://tools.ietf.org/html/draft-johansson-fticks-00>
> [2] https://monitor.eduroam.org/f-ticks/ <https://monitor.eduroam.org/f-ticks/>
> [3] http://iam.cf.ac.uk/trac/RAPTOR <http://iam.cf.ac.uk/trac/RAPTOR>
> [4] https://github.com/SUNET/flog <https://github.com/SUNET/flog>
> 



> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net