How to log failed logins?

[Charles R. Tompkins]

In IdP v2, I used:
%date{HH:mm:ss.SSS} - %level [%logger:%line] -
idpSessionId[%mdc{idpSessionId}],JSESSIONID[%mdc{JSESSIONID}],clientIP[%mdc{
clientIP}] - %msg%n

But in IdP v3 I use this:
%date{HH:mm:ss.SSS} - %level [%logger:%line] -
idpSessionId[%mdc{idp.idpsessionid}],JSESSIONID[%mdc{idp.jsessionid}],client
IP[%mdc{idp.remote_addr}] - %msg%n`

... However, my guess at the MDC key for "idpSessionId" doesn't work.  Does
anyone know the correct syntax for that idpSessionId value?

Charles Tompkins
UF Information Technology





-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Eric Wedaa
Sent: Thursday, January 21, 2016 7:43 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: How to log failed logins?

NEvermind, there it is, IDP_PROCESS.  Now lets see if I can get it to wrok
:-)

>>>>>Ericw

-----"users" <users-bounces at shibboleth.net> wrote: -----
To: Shib Users <users at shibboleth.net>
From: Eric Wedaa 
Sent by: "users" 
Date: 01/21/2016 07:34PM
Subject: RE: How to log failed logins?

Yep, and it's clear as mud to me.  And this is the 2.0 docs so it won't get
fixed since 3.0 is out now.  Where does the pattern go?  It goes in
logging.xml someplace, but I'm not a big xml guy, I'm just trying to get
this thing to work for us.  A little more context around the examples would
be a big help to those of us just getting started. :-)  I know a lot of you
guys are shib gurus, but the rest of us aren't :-(

Example Logging Pattern using Client IP in Audit Log 
<Pattern>%msg%mdc{clientIP}|%n</Pattern>
>>Ericw

-----"users" <users-bounces at shibboleth.net> wrote: -----
To: Shib Users <users at shibboleth.net>
From: "Cantor, Scott" 
Sent by: "users" 
Date: 01/21/2016 07:19PM
Subject: RE: How to log failed logins?

> Now to go find docs (that I may not understand) about using logback.  (If
> anyone wants to post about that I would reallllllly appreciate it!)

I don't even think the IP addition is a logback thing, it's right in our
documentation.

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPLogging

-- Scott

-- 
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net
-- 
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net
-- 
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4793 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20160122/ae8a533a/attachment-0001.p7s>