Turning up logging for the IdP data sealer

[Wessel, Keith]

Hi, all,

My containerized IdPs don't seem to be staying in sync with the fancy data sealer key generation we have coming out of a Lambda function in AWS.

2020-10-26 09:19:15,558 - 99.74.22.187 - ERROR [net.shibboleth.utilities.java.support.security.DataSealer:252] - Exception unwrapping data: Tag mismatch!

I'd like a bit more visibility into what's leading up to this error. What class do I need to turn up logging for? Is it net.shibboleth.utilities.java.support.security.DataSealer? This seems like the logical choice based on what I see, but I've learned that it's not always what class to turn up based solely on the exception that's logged.

Thanks,
Keith