How to log failed logins?

[Brent Putman]

On 1/21/16 6:10 PM, Cantor, Scott wrote:
>> In V2, you can get this to happen (presumably for any authN method) if you
>> set the logger for "edu.internet2.middleware.shibboleth.idp.authn" to
>> DEBUG.
>>
>> Look for:
>>
>> successful authentication events:  "Login by '<username>' succeeded"
>>
>> failed authentication events: "Login by '<username>’ failed"

Hmmm, I don't see anything like that in my logs with the whole IdP on
DEBUG.  All I see is output from the username/password servlet, but the
text is different:

19:33:51.551 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:194]
- User authentication for putmanb failed

19:34:36.749 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:178]
- Successfully authenticated user putmanb

I don't have the original OP here, but if you have an actual log output
example, at least with the actual class name, that would be helpful.

Barring that, I can't see that we have any generalized output from the
authN subsystem that we could just bump up.



> That I was not aware of (I knew nothing was there on INFO). If people think we should raise that to INFO, there is one more patch coming...


If there's existing centralized DEBUG output I'm missing, I'll bump it
up, but if it's distributed across all the different login handler
impls, that's probably not as do-able.

Don't have the beginning of this thread, but not sure how we even would
deal with several cases: 1) the RemoteUser- and ExternalAuthnSystem-
ones, those logs would happen in the external thing anyway 2)
PreviousSession, would we want output from that 3) IPAddress-, the
principal is the same so presumably would want the IP address.

But if all we really care about is the JAAS UsernamePassword- output
like my example above, then if people want that bumped to INFO, that's
easy enough.

   
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160127/4633c2d0/attachment.html>