Logging TLS cipher suite

[Cantor, Scott]

Forgive the InCommon spam but this came up on a webinar about the upcoming change to require participants to turn off TLS 1.0 and 1.1.

Assuming you don't proxy (yet another reason proxying sucks), there are a lot of ways to do this, including adding a field to the idP audit log, but a simple and all-purpose way I found to log it is just in the servlet access log by changing the logback-access pattern to:

<pattern>
%h %l %u [%t] "%r" %s %b "%i{Referer}" "%i{User-Agent}" %reqAttribute{javax.servlet.request.cipher_suite}
</pattern>

That's "combined" plus the attribute with the cipher.

I added a blurb about it to the Jetty94 page. Tomcat supports logback use as well for access logging and the same configuration would probably work, dunno.

-- Scott