audit log entry for null CAS service

[Cantor, Scott]

> What would a SAML error look like in the audit log?  I see many kinds of
> errors in the process log, but I can only find successful SAML
> authentications in the audit log.

That depends what you log, there are fields available for SAML status and for event IDs resulting from the flow execution.

2017-11-14T12:15:18.093-05:00|Audit.SAML2.SSO||https://webauth.cashnet.com/incpay|||||||Redirect||NoCredentials||||Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36 Edge/14.14393|75.35.1.19||2017-11-14T12:13:20.925-05:00

That's somebody canceling a login on the Duo step, which doesn't happen to return to the SP, so there's no SAML status, but the event ID is NoCredentials.

-- Scott