Ex: Re: Duo flow authn audit

[Paul B. Henson]

On Fri, Apr 07, 2023 at 07:08:48PM +0000, Cantor, Scott wrote:

> There's literally no way what you're saying is possible

It seems you need to expand your vision as to the endless possibilities
that exist in software development ;).


So when ValidateDuoWebResponse called recordSuccess, the
writeAuditLogAction variable in AbstractAuditingValidationAction was
null, so the call to doAudit was a noop.

I tracked this down to duo-authn-beans.xml, which contained:

    <bean id="ValidateDuoWebResponse" scope="prototype"
        [...]
	p:writeAuditLogAction="#{%{idp.authn.Duo.audit.enabled:%{idp.authn.audit.enabled:false}} ? getObject('WriteAuditLog') : null}"


As opposed to password-authn-beans.xml, which contains:

    <bean id="ValidateCredentials"
        [...]
	p:writeAuditLogAction="#{%{idp.authn.Password.audit.enabled:%{idp.authn.audit.enabled:false}} ? getObject('WriteAuthnAuditLog') : null}"


When I updated the duo-authn-beans.xml config to use WriteAuthnAuditLog
instead of WriteAuditLog, magic happened:

2023-04-07 17:37:52,547 - 10.104.223.17|2023-04-08T00:37:52.546970Z|https://sp.test.calstate.edu/shibboleth-sp|_ae815dd19290000914079ebeb8523654||authn/Password|krb5|henson|henson|Success|Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0 - [10.104.223.17/node0ltcbjo68wjfcwpvkbz8jccqn17]
2023-04-07 17:38:00,715 - 10.104.223.17|2023-04-08T00:38:00.715457Z|https://sp.test.calstate.edu/shibboleth-sp|_ae815dd19290000914079ebeb8523654||authn/Duo|henson|Success|DIT3F09V1XRBL45PWY7S|||Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0 - [10.104.223.17/node0ltcbjo68wjfcwpvkbz8jccqn17]


Soooooo....... I see the same issue exists in the main branch, so I
assume this is an unfixed bug. I present for your consideration
IDP-2089:

	https://shibboleth.atlassian.net/browse/IDP-2089


Thanks...

-- 
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768