Missing username from the audit log

[Eric Hattemer]

It's probably something weird I did, but we're running IdP 3.2.1 with
the default audit.xml, and about 5% of our audit log entries don't have
any values for the %u (Username), %III (Outbound message ID), %bb
(Outbound binding), and %attr (Names of released attributes) fields.  I
can reproduce the problem by logging into a site that requires
ForceAuthn=true, logging out of that SP, then logging in again while
presenting all the cookies.  If I delete the cookies or do private
browsing on the second login, it logs the username properly.  And if I
restart the IdP in between but still present the cookies, I still do not
get the username.  The attributes are released in the response, even
though it doesn't log them.

I can reproduce the problem with ForceAuthn, but it shows up in the logs
for SP's that don't use that.

We use the idp.storage.htmlLocalStorage property.

If normal people don't get anything for:

awk -F\| '{if($7!~/[A-z]+/){print}}' $IDP_HOME/logs/idp-audit.log|wc -l

Then it must be something weird I did with our flows, and I'll fix it up
with the standard MFA flow when we upgrade to at least 3.3.1.

-Eric Hattemer