Ex: Re: Duo flow authn audit

Fri Apr 7 18:58:59 UTC 2023

> From: Cantor, Scott
> Sent: Friday, April 7, 2023 6:13 AM
> 
> Don't know, that's all it takes. If the metric counter is increasing the success
> count, the same code path logs the evemt.

Yep, net.shibboleth.idp.authn.duo.successes is increasing.

So if I enable the authentication auditing, but don't add any additional logging config, it should just end up in the existing audit log file, right? I tried that, and I see the Password entry in the standard audit log file next to the usual one, but still no Duo entry? I'm using the legacy Duo stuff still, not the universal prompt, does that make a difference?

2023-04-07 11:55:24,554 - 10.104.223.17|2023-04-07T18:55:24.554179Z|https://sp.test.calstate.edu/shibboleth-sp|_ba4a0dfe49e33d123f8b84950f5e18ab||authn/Password|krb5|henson|henson|Success|Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0 - [10.104.223.17/node0uefwlfuvt87u9wp84asigxpk599]
2023-04-07 11:55:31,201 - 10.104.223.17|2023-04-07T18:55:19.482428Z|2023-04-07T18:55:31.201281Z|henson|https://sp.test.calstate.edu/shibboleth-sp|_3bb0d3f15a5142b1081a1cfb681f05cd|password|2023-04-07T18:55:30.978209Z|eduPersonEntitlement,telephoneNumber,mail,eduPersonAffiliation,calstateEduPersonID,displayName,givenName,calstateEduPersonAffiliation,eduPersonScopedAffiliation,calstateEduPersonEmplID,eduPersonPrincipalName,sn,calstateEduPersonOrg,calstateEduPersonPrincipalName|AAlzZWNyZXQxMjgDrmWRglO+/Hft4Kl/55GeoB/qOrNhzmS2z+ruPEd69xO52dbZ6sxTkz6dhdfkpUVHllh5J2h4ABL0G8NbaOaUBTMAFj2ifw/fp8Wux4GS/Cng9G0BMkdhtzmYbK2blFrQ7ZA/n8wn1ywa6GKcXg0=|transient|false|false|AES128-GCM|POST|POST||Success||e1734dcb3195f67fae3092c89e22c94927d981860f6c333af071bb91c7f14ef7|Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0 - [10.104.223.17/node0uefwlfuvt87u9wp84asigxpk599]