Ex: Re: Duo flow authn audit

[Paul B. Henson]

On a side note, I guess I haven't worked on the idp since you stopped
copying your artifacts to maven central. The build kept complaining about
not finding pom files. I double checked the docs at:

	https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631879/DevelopmentEnvironmentSetup

In particular the Maven section:

	https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/1123450991/Setting+Up+Configuring+and+Using+Maven

but even with the shown settings.xml in place it kept barfing. I did
some hack and slash with repository definitions in the
idp-parent pom.xml file and got it to package successfully other
than the maven.enforcer part still failed, which happens afterwards so I
ignored it.

Obviously I couldn't do the ssh tunneling as the settings file is shown
on the wiki so I commented that out and uncommented the section with
build.shibboleth.net URLs.

I assume I did something wrong, but I also assume the vast majority of
compilation is by developers who do use the tunnel and likely eclipse
rather than maven directly so perhaps there's an issue with the config
for those who don't.


On Fri, Apr 07, 2023 at 07:08:48PM +0000, Cantor, Scott wrote:
> > Yep, net.shibboleth.idp.authn.duo.successes is increasing.
> 
> Well, it writes to the audit log on an adjacent line of code to the line that increments that.
> 
>         doAudit(profileRequestContext);
>         super.recordSuccess(profileRequestContext);
> 
> The superclass method increments the counter.
> 
> > So if I enable the authentication auditing, but don't add any additional logging
> > config, it should just end up in the existing audit log file, right?
> 
> The process log is the default appender, but if you have a logger for Shibboleth-Audit going somewhere it would probably pick them up if the names match.
> 
> > I'm using the legacy Duo stuff still, not the universal prompt, does that make a
> > difference?
> 
> The plugin has a different logging mechanism until they get aligned down the road, so it's the opposite, the original flow uses the same general approach Password does.
> 
> There's literally no way what you're saying is possible so "facts not in evidence" is the only apparent explanation.
> 
> -- Scott
> 
> 
> CAUTION: This email was not sent from a Cal Poly Pomona service. Exercise caution when clicking links or opening attachments. Please forward suspicious email to suspectemail at cpp.edu<mailto:suspectemail at cpp.edu>.
> 

-- 
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768