How to log failed logins?

[Eric Wedaa]

What I'm trying to do is to log at the IDP when the user enters a username and password that does not succeed.  Elsewhere on the lists it mentioned greping for "failed" in the idp.process log (if I remember right).  I need to watch for brute force attacks, among other things.  I get this functionality with CAS and with SSH, and I've seen others talking about it for Shib, so I know it can be done somehow. I just don't know how.

Is that clearer?

>>Ericw

-----"users" <users-bounces at shibboleth.net> wrote: -----
To: Shib Users <users at shibboleth.net>
From: "Cantor, Scott" 
Sent by: "users" 
Date: 01/21/2016 04:09PM
Subject: RE: How to log failed logins?

> That's right, I'm trying to log this at the IDP, not at the SP.

Yes, and I'm talking about the IdP also. You cannot expect to log all failures *at the IdP layer* because the user never has a chance to say "I give up" and they wouldn't click that if they did have it, thus your approach of using the vt-ldap logging category is the correct one. That's all I meant.

It's logged by the authentication back-end and maybe by the library calling that back-end. The best way to get it is actually not in Shibboleth, it's in the back-end's logs.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net