How to log failed logins?

[Cantor, Scott]

> What I'm trying to do is to log at the IDP when the user enters a username
> and password that does not succeed.  Elsewhere on the lists it mentioned
> greping for "failed" in the idp.process log (if I remember right).  I need to
> watch for brute force attacks, among other things.

And I'm just telling you that the old IdP doesn't do that, only the underlying authentication components do.

If you want to *know* the situation, you go to the actual back-end. LDAP, Kerberos, AD, whatever. Their logs are the ones you really want.

If you want to get the answer on the IdP side in V2, you are relying on the libraries that are calling those back-ends, and that's not a single answer. If you're doing LDAP with the provided code, that's the vt-ldap code, so that is the logging you're looking for, you just used the wrong category I guess. I don't know the correct one offhand, but I log all of the vt-ldap categories on INFO, and I don't think you'll find that very noisy.

-- Scott