Sending the SAMLReply/Assertion

[Jan Vilhuber]

From: users <users-bounces at shibboleth.net> on behalf of Peter Schober <peter.schober at univie.ac.at>
Date: Friday, 2 July 2021 at 15:03
To: users at shibboleth.net <users at shibboleth.net>
Subject: Re: Sending the SAMLReply/Assertion
* Jan Vilhuber <JVilhuber at absolute.com> [2021-07-02 04:05]:
> I’m trying to figure out how I can gather usage metrics from
> shibboleth SP

The transaction log should cover "usage metrics" use cases just fine
(always provided you do the parsing and convertion into time series
data yourself).

What I’m specifically looking for is things like which hashing and encryption algorithms (and hopefully which certificate was used, i.e. things like SP subject-name and serial number) were used (and by whom). The purpose is to find out who I need to alert that they may need to update their settings to more secure algorithms or move to a new cert (in certificate rollover scenarios). I haven’t found any way to get this info into the transaction log.

>   1.  Process signature debug logs and turn them into metrics (then discarding them, as they contain sensitive information), or
>   2.  Sending the SAMLReply or Assertion to some endpoint when it is received (after processing and validation), so some other service can turn it into metrics.
> Is there some way I can send the raw reply or at least the Assertion to an API? Or perhaps turn the whole thing into an HTTP header and forward it along with the attributes it normally sends?

Why would you need signature debug logs
This is where crypto algorithm and certificate information can be gleaned.

(and why would there be
sensitive information in them?)
Since we’re dumping assertions, user attributes can be seen, which contain PII.

Another idea: Is there an SP API (Soap or otherwise) where I might be able to get the saml assertion from the SP given a session Index?

Regards,
Jan

or raw assertions for "usage metrics"?

-peter
--
For Consortium Member technical support, see https://urldefense.com/v3/__https://wiki.shibboleth.net/confluence/x/coFAAg__;!!GEjU_1jlQXGQfQ!3mu6PuXWRYuv385iD9dy2ew9ml57DW_pwuUiiAVV0hS_ipi31dK0l60uROZlSRUVug$<https://urldefense.com/v3/__https:/wiki.shibboleth.net/confluence/x/coFAAg__;!!GEjU_1jlQXGQfQ!3mu6PuXWRYuv385iD9dy2ew9ml57DW_pwuUiiAVV0hS_ipi31dK0l60uROZlSRUVug$>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210712/25342f35/attachment.htm>