missing URL-encoding in audit log

[Andrew Morgan]

On Mon, 24 Jul 2017, Cantor, Scott wrote:

> On 7/24/17, 6:23 PM, "users on behalf of Andrew Morgan" 
> <users-bounces at shibboleth.net on behalf of morgan at orst.edu> wrote:
>
>> I didn't find an open bug for this.  Should the IDP be escaping the 
>> pipe symbol somehow?
>
> I'm not sure if it's legal in a URL in general, but the audit log 
> doesn't know anything about what delimiter you're using because that's 
> arbitrary. So it would probably require that some kind of pluggable 
> behavior be used, which is sort of already what it has since the audit 
> field can be overridden with an arbitrary script or class to produce the 
> value to log.

The original Apache logs have it URL-encoded:

[23/Jul/2017:14:08:10 -0700] "GET /idp/profile/cas/login?service=https%3A%2F%2Fcourses.ecampus.oregonstate.edu%2Ffishes-collection%2Fimage.php%3Fid%3D1038%7CisIframe HTTP/1.1" 302 398
[23/Jul/2017:14:08:35 -0700] "POST /cas/samlValidate?TARGET=https%3A%2F%2Fcourses.ecampus.oregonstate.edu%2Ffishes-collection%2Fimage.php%3Fid%3D1038%7CisIframe HTTP/1.1" 200 11906

so it appears that the clients are doing the right thing to encode it.

I don't see docs on using a script to produce the value on 
https://wiki.shibboleth.net/confluence/display/IDP30/AuditLoggingConfiguration.

I see a new feature in 3.3 is shibboleth.AuditFieldReplacementMap.  Could 
I use that to replace "|" with "%6C"?  Something like this in audit.xml:

     <util:map id="shibboleth.AuditFieldReplacementMap">
         <entry key="|" value="%6C" />
     </util:map>

Thanks,
 	Andy