Turning up logging for the IdP data sealer

[Cantor, Scott]

On 10/26/20, 1:38 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

>    I'd like a bit more visibility into what's leading up to this error. What class do I need to turn up logging for? Is it
> net.shibboleth.utilities.java.support.security.DataSealer? This seems like the logical choice based on what I see, but I've
> learned that it's not always what class to turn up based solely on the exception that's logged.

Should be, but you need TRACE to actually log any of the data. It's not going to show much, a tag error is an AEAD signal that the data has been tampered with. If not, then the key it loaded for a given alias is not the key that was used to encrypt it. The point of the rolling key version strings is to ensure that a given value always means the same key to every node so that should never happen.

-- Scott