Audit log recording authentication failures?

[Cantor, Scott]

On 12/14/16, 6:43 PM, "users on behalf of Misagh Moayyed" <users-bounces at shibboleth.net on behalf of mmoayyed at unicon.net> wrote:

>    Is there a place on the wiki that could describe what one might do to let the audit log record authentication failures? Is
> that a behavior that needs to be turned on explicitly, or does the IdP simply not record AuthN failures? 

It does not and cannot audit login failures. Audit records are the result of a profile flow, not of a login attempt. A failed login may never even lead to an audit record because the user just stops trying. There's no point at which the IdP knows that it actually has failed unless something really causes authentication to "finish" unsuccessfully, and that's very rare in practice when passwords are involved.

It *reports* login failures with full details in the diagnostic log, and it also counts them now with the metrics support.

-- Scott