logging the outgoing SAML

[Brent Putman]

On 8/31/17 1:37 PM, IAM David Bantz wrote:
>
> How can I get all the unencrypted assertions, which I often need to
> help service owners diagnose failures?
>

It's the PROTOCOL_MESSAGE logger category, set it to DEBUG.  That logs
all incoming and outgoing SAML protocol messages. 

If the Assertion is encrypted in the Response message, then
PROTOCOL_MESSAGE won't help (at least, if you want to see the Assertion
contents) and that's why you'd need to turn on the
org.opensaml.saml.saml2.encryption.Encrypter one, which logs the
Assertion *before* it is encrypted.

HTH,
Brent


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170831/5cf2ecf2/attachment.html>