Audit Authentication Events

[Eric Goodman]

>>I added AuthenticationInstant to my audit logs.  Comparing that to the event time was enough to give them most of what they wanted

>That's a practical approach that I considered myself, but seemed like too much hassle for our logging and reporting infrastructure. (Maybe I'm just lazy.)

>An actual indicator would be better still, though.

>https://issues.shibboleth.net/jira/browse/IDP-908


On the topic of determining whether an authentication event “just happened”:



A while back I asked whether it would be best to determine this by comparing the AuthnInstant to the event time (“now” on the local clock) vs. the assertion creation time (“IssueInstant” in the assertion/response).



The point behind the question is that (“now” – AuthnInstant) will be affected by the relative clockskew of the log entry recipient vs. the IdP, whereas (IssueInstant – AuthnInstant) will be affected by the relative clockskew of the authenticating agent vs. the IdP.



I originally asked this question in the context of an SP verifying whether forceAuthn was actually honored (using “maxTimeSinceAuthn”), where the SP doesn’t have access to the internal sessions. If you ignore the minor point that the IdP doing the logging does have such access (and is likely doing the authentication and the logging locally anyway), do folks have any opinion on which approach is actually “better”?



--- Eric


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160122/07adda4a/attachment.html>