missing URL-encoding in audit log

[Cantor, Scott]

On 7/24/17, 7:26 PM, "users on behalf of Andrew Morgan" <users-bounces at shibboleth.net on behalf of morgan at orst.edu> wrote:

> The original Apache logs have it URL-encoded:

Right, but that's a query parameter at that point. As a value in the system, it's not going to be encoded when it's being handled unless it becomes a parameter again. If it were, you couldn't perform accurate comparisons against the value for policy. Ultimately if you stuck bad characters like this into an entityID you'd have the same problem.

> so it appears that the clients are doing the right thing to encode it.

But it's not encoded in the URL itself. It may not have to be if pipes are legal, I wouldn't know offhand.

To the IdP, it's the name of a service and it's just literal text.

> I don't see docs on using a script to produce the value on 
> https://wiki.shibboleth.net/confluence/display/IDP30/AuditLoggingConfiguration.

I don't have any examples that I know of. You have to plug in code into one of, or several of, the placeholder field maps in audit.xml to override the field that's being populated with the unencoded name. You'd have to look at audit-system.xml to see what this all looks like. The beans are Function<ProfileRequestContext,String>, and it's possible to do it with scripts using the shibboleth.ContextFunctions.Scripted bean.

If you provide a field map entry with a key of net.shibboleth.idp.cas.protocol.CASAuditFields.SERVICE_URL (which is just "SP"), that definition of the the field will overwrite the system's definition, so it allows you to replace the field with your own version.

> I see a new feature in 3.3 is shibboleth.AuditFieldReplacementMap.  Could 
> I use that to replace "|" with "%6C"?  Something like this in audit.xml:

No, that's used to substitute for entire strings, I use it to collapse URI constants into strings, like POST or Redirect.

-- Scott