logging the outgoing SAML

[IAM David Bantz]

Ah, yes. Thanks Brent.
Seems a shame to add all that encrypted data to the logs just to get the
outgoing SAML for a minority of unencrypted assertions.
Motivation to keep up with log rotation I guess...

David

On Thu, Aug 31, 2017 at 10:18 AM, Brent Putman <putmanb at georgetown.edu>
wrote:

>
>
> On 8/31/17 1:37 PM, IAM David Bantz wrote:
>
>
> How can I get all the unencrypted assertions, which I often need to help
> service owners diagnose failures?
>
>
> It's the PROTOCOL_MESSAGE logger category, set it to DEBUG.  That logs all
> incoming and outgoing SAML protocol messages.
>
> If the Assertion is encrypted in the Response message, then
> PROTOCOL_MESSAGE won't help (at least, if you want to see the Assertion
> contents) and that's why you'd need to turn on the
> org.opensaml.saml.saml2.encryption.Encrypter one, which logs the
> Assertion *before* it is encrypted.
>
> HTH,
> Brent
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170831/384bba87/attachment.html>