How to log failed logins?

[IAM David Bantz]

Apologies in advance if I'm misunderstanding the request; here are examples
of what I log:

Bare fact of failed LDAP authN at INFO level:

> INFO [edu.vt.middleware.ldap.jaas.JaasAuthenticator:180] - Authentication
> failed for dn: uid=••••••,dc=alaska,dc=edu

Further details (LDAP error message) at DEBUG level:

> DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:136] - Authentication
> failed
> javax.naming.AuthenticationException: [LDAP: error code 49 - Invalid
> Credentials]


David Bantz
U Alaska

On Thu, Jan 21, 2016 at 1:47 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > What I'm trying to do is to log at the IDP when the user enters a
> username
> > and password that does not succeed.  Elsewhere on the lists it mentioned
> > greping for "failed" in the idp.process log (if I remember right).  I
> need to
> > watch for brute force attacks, among other things.
>
> And I'm just telling you that the old IdP doesn't do that, only the
> underlying authentication components do.
>
> If you want to *know* the situation, you go to the actual back-end. LDAP,
> Kerberos, AD, whatever. Their logs are the ones you really want.
>
> If you want to get the answer on the IdP side in V2, you are relying on
> the libraries that are calling those back-ends, and that's not a single
> answer. If you're doing LDAP with the provided code, that's the vt-ldap
> code, so that is the logging you're looking for, you just used the wrong
> category I guess. I don't know the correct one offhand, but I log all of
> the vt-ldap categories on INFO, and I don't think you'll find that very
> noisy.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160121/203f0739/attachment.html>