logging http message in HTTP Redirect binding

[Brent Putman]

On 6/7/16 5:43 AM, SAMUELE RILLI wrote:
>
> I've configured a Shibboleth SP and a IdP to communicate together.
> When the SP sends an authentication request to the IdP through the
> HTTP Redirect binding, I need the IdP to log the whole http message
> which includes both the SAML authnRequest and the SP detached
> signature in the Signature parameter.
>

You can't log them in one single log message.  As others have pointed
out, you can do that with servlet container logging of the request itself.

However, you can log the decoded SAML protocol message and separately
log the query string that was received.  The latter is via the handler
that evals the Redirect binding signature. 


> Is it possible? Do I need to add further logger(s) to the logback.xml?

I'll assume you're asking about v3 IdP here.

Log these 2 categories on level DEBUG:

PROTOCOL_MESSAGE
org.opensaml.saml.saml2.binding.security.impl.SAML2HTTPRedirectDeflateSignatureSecurityHandler


For the second, you should see a line beginning with "Constructing
signed content string from URL query string ...".

For that, you could also be less specific and get more logging, by
configuring to log org.opensaml.saml.saml2.binding.security.impl  or
org.opensaml.saml.saml2.binding.security, etc.  As you like.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160607/095ff3ec/attachment-0001.html>