Ex: Re: which SP when signature validation fails?

[Paul B. Henson]

> From: Peter Schober
> Sent: Saturday, July 8, 2023 4:10 PM
> 
> At least when the HTTP-Redirect protocol binding was used you'd find
> the authn request in your web server's logs (though you'd have to
> decode it yourself). There may be a "referer" in that log as well.

Yeah, assuming not a ridiculous amount of traffic at the time I can do a pretty reasonable correlation based on timestamp and source IP address; looks like this one is actually a post binding, but does include a referrer pointing out the culprit:

2023-07-08 20:30:59,331 - 10.104.223.125/node04qrx7hxnxj2xt2wc4iz4kcny110466 - WARN [org.apache.xml.security.signature.XMLSignature:883] - Signature verification failed.

10.104.223.125 - - [08/Jul/2023:20:30:59 -0700] "POST /idp/profile/SAML2/POST/SSO HTTP/1.1" 400 5414 "https://
platform.boomi.com/" "Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0"

> Probably best to file an issue to have the entityID logged
> specifically in the event of failing signature validation?

If Scott doesn't point out something simple I'm missing :) I'll probably go ahead and open an issue and maybe poke around in the code to see how hard it would be to add.

Thanks...