which SP when signature validation fails?

[Cantor, Scott]

> Pretty sure it didn't log anything. Looks like the process log includes
> the entity-id for Redirect failures but not POST failures, maybe the
> audit log is the same? If so, should I open a second issue?

Talking about the audit log, the process log is for after the fact debugging, not day to day monitoring.

The reason it's not logging is that a MessageAuthenticationError event is handled "locally" (it's not going to issue a response to an untrusted SP) and the default for that is not to audit unless it's spelled out to do so in the local event map in errors.xml. Unlisted events default to a value of false in that map.

Even mine wasn't auditing this (because as I say, I just don't really care) but it's auditable once it's told to.

I'll add it to the default file.

-- Scott