native SP logger enhancement: include applicationId

[Guillaume Rousse]

Le 19/04/2018 à 15:56, Cantor, Scott a écrit :
>> We already asked the editor to review its application behavior, to detect
>> session expiration on client side, and stop harassing the server with useless
>> requests. Is there anything else we could do on Shibboleth side to limit the
>> problem, beyond raising the logger threshold, before it get fixed ?
> 
> What would you imagine it could do?
The current (simple) configuration requires all requests to be 
authenticated, starting a complete authentication process for any 
unauthenticated one, redirecting them to the discovery service:
<Location />
     AuthType shibboleth
     ShibRequestSetting requireSession On
     ShibRequestSetting applicationId scaner
     ShibUseHeaders On
     Require shib-session
</Location>

One may imagine another configuration that would try to make a 
distinction between requests resulting from human-initiated action (GET 
requests, for instance), and those sort of keep-alive background 
requests. Only unautenticated requests from the first category would be 
redirected to the discovery service, whereas unauthenticated requests 
from the second category would be just replied with a 403 (or similar) 
error status.

Alternatively, one may imagine juste rate-limiting unauthenticated 
requests redirection, for instance only one by remote address by minute, 
dropping others.

In both case, this seems to be a job for the web server, provided it can 
process requests before they are handled to the native mod_shib handler, 
and can distinguish authenticated from unauthenticated requests.

Regards.
-- 
Guillaume Rousse
Pôle SSI

Tel: +33 1 53 94 20 45
www.renater.fr

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3637 bytes
Desc: Signature cryptographique S/MIME
URL: <http://shibboleth.net/pipermail/users/attachments/20180419/136b5e02/attachment.p7s>