Ex: Re: which SP when signature validation fails?

[Paul B. Henson]

On Sun, Jul 09, 2023 at 05:40:37PM +0000, Cantor, Scott via users wrote:
> The audit log should have something if it's suitably customized (or
> maybe even if not).

Hmm, my audit log is stock other than adding idp.remote_addr and
idp.jsessionid, doesn't seem to be anything:

# grep 10.104.223.126 /var/log/idp/idp-process.log
2023-07-09 11:44:51,681 -
10.104.223.126/node01hoxfyzaa5p8v65zcte2k8kn5136959 - WARN
[org.apache.xml.security.signature.XMLSignature:883] - Signature
verification failed.
2023-07-09 11:44:51,683 -
10.104.223.126/node01hoxfyzaa5p8v65zcte2k8kn5136959 - WARN
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] -
Profile Action WebFlowMessageHandlerAdaptor: Exception handling message
2023-07-09 11:44:51,685 -
10.104.223.126/node01hoxfyzaa5p8v65zcte2k8kn5136959 - WARN
[org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event
occurred while processing the request: MessageAuthenticationError

# grep 10.104.223.126 /var/log/idp/idp-audit.log
<nope>

Looking at the config, it seems to mostly talk about changing what
fields are audited for a given event, not making it audit more events?
Unless you need to add fields for the "signature failed" event which
will make it log it?

> I don't really get the concern since whoever is trying it should know
> what it is they're trying to access.

Heh. You've worked with "end users" before, right ;)? "Help me, stuff
isn't working!!!!"

Also, it would be nice to find out immediately and remediate something
proactively rather than to wait for possibly important and angry muckity
mucks to start complaining. I saw the signature errors in the logs for a
few days before I finally got a user report.

> A failure would be when setting something up anyway, rarely if ever
> afterward.

One of our commercial services that doesn't use a federation and has
manually configured metadata rolled a signing cert. They notified the
end users of the service who had no idea what that meant. Until the
service broke. Given the number of companies that think a federation
isn't worth it but use commercial certs rolled every year, I'm not sure
that "rarely" is the best way to describe possibly getting out of sync
<sigh>.


-- 
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768