How to log failed logins?

[Cantor, Scott]

> That's right, I'm trying to log this at the IDP, not at the SP.

Yes, and I'm talking about the IdP also. You cannot expect to log all failures *at the IdP layer* because the user never has a chance to say "I give up" and they wouldn't click that if they did have it, thus your approach of using the vt-ldap logging category is the correct one. That's all I meant.

It's logged by the authentication back-end and maybe by the library calling that back-end. The best way to get it is actually not in Shibboleth, it's in the back-end's logs.

-- Scott