which SP when signature validation fails?

[Peter Schober]

* Paul B. Henson <henson at cpp.edu> [2023-07-08 03:34]:
> I had an issue today when somebody was complaining about failed SSO
> that turned out to be an authentication request whose signature
> could not be validated. I'm not sure if I'm missing something, but I
> don't see anything in the logs that tells me which SP that was?

At least when the HTTP-Redirect protocol binding was used you'd find
the authn request in your web server's logs (though you'd have to
decode it yourself). There may be a "referer" in that log as well.

The distributed logback.xml has this to offer

    <!-- Logs inbound and outbound protocols messages at DEBUG level -->
    <logger name="PROTOCOL_MESSAGE" level="${idp.loglevel.messages}" />

but that may be a bit excessive.

Probably best to file an issue to have the entityID logged
specifically in the event of failing signature validation?
Though that only tells you which SP to test with while you still end
up enabling debug logging for PROTOCOL_MESSAGE, I guess.

-peter