which SP when signature validation fails?

[Cantor, Scott]

> Looking at the config, it seems to mostly talk about changing what
> fields are audited for a given event, not making it audit more events?

It logs the result of every request except for a few cases, and if it's not logging enough to flag which transaction is the problem, that's the thing you have to adjust.

If it's not auditing the event at all, that's a bug.

We collect the basic info after decoding the request, and signature checks are after that step, so it should be able to log something.

> Unless you need to add fields for the "signature failed" event which
> will make it log it?

It should be logging it, but if you can't tell which entry it is, that's the problem.

> Heh. You've worked with "end users" before, right ;)? "Help me, stuff
> isn't working!!!!"

Yes, but one follow up is usually enough for me to find out if I can't tell from the log.

> One of our commercial services that doesn't use a federation and has
> manually configured metadata rolled a signing cert. They notified the
> end users of the service who had no idea what that meant.

Yes, but I tell them why it broke and I give them the tools needed to avoid the problem (which they often ignore) and then I just move on. If it's a recurring issue, I bypass the key as leaving time bombs in the system is usually a bad idea.

-- Scott