How to log failed logins?

[Paul Caskey]

In V2, you can get this to happen (presumably for any authN method) if you set the logger for "edu.internet2.middleware.shibboleth.idp.authn" to DEBUG.

Look for:

successful authentication events:  "Login by '<username>' succeeded"

failed authentication events: "Login by '<username>’ failed"

Never had the chance (yet) to test this on V3…









On 1/21/16, 4:47 PM, "users on behalf of Cantor, Scott" <users-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

>> What I'm trying to do is to log at the IDP when the user enters a username
>> and password that does not succeed.  Elsewhere on the lists it mentioned
>> greping for "failed" in the idp.process log (if I remember right).  I need to
>> watch for brute force attacks, among other things.
>
>And I'm just telling you that the old IdP doesn't do that, only the underlying authentication components do.
>
>If you want to *know* the situation, you go to the actual back-end. LDAP, Kerberos, AD, whatever. Their logs are the ones you really want.
>
>If you want to get the answer on the IdP side in V2, you are relying on the libraries that are calling those back-ends, and that's not a single answer. If you're doing LDAP with the provided code, that's the vt-ldap code, so that is the logging you're looking for, you just used the wrong category I guess. I don't know the correct one offhand, but I log all of the vt-ldap categories on INFO, and I don't think you'll find that very noisy.
>
>-- Scott
>
>-- 
>To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net