logs not matching resolver test

[IAM David Bantz]

On Mar 6, 2023 at 17:29:19, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

> The audit log logs released attributes, it does not log encoded ones.
> Adding the SAML encoding option means you're seeing what can be encoded,
> and that's not the same.
>

So to elaborate for my clarity, that means

   - presence of attribute name(s) in audit log indicates those attributes
   were “OK’d” by release policies
   - presumably (yes?) that entails those attributes had values (not null)
   or they wouldn’t have been checked against release policies
   - but somehow encoders for those attributes were not triggered - at
   least when running the resolver exerciser


I realize that in principle an attribute could be populated and released by
policy but not be encoded, but I’m seeing even the most ‘basic’ of
attributes with encoders in their definitions (ePPN, uid, …) show up in
audit log by name, but not in the resolver exerciser (maybe related to the
puzzle of no process log entries for the resolver exerciser). I’ve tried
the resolver exerciser with an attribute reflector SP - for most users,
lots of lines in the attribute statement saml, but for the problematic
ones, no attribute statement at all. I hadn’t noticed previously, but
there’s no SAML at all: no issuer or subject as well as no attribute
statement.


> ...why doesn’t the resolver test trigger log entries in ids-process.log ?
> [err, idp-process.log]
>
>
> It does.
>

Is there a specific logger I need to include in the logback config to see
them? With the current knobs all at “DEBUG” in my standby:

  <!-- Logging level shortcuts. -->
    <variable name="idp.loglevel.idp" value="DEBUG" />
    <variable name="idp.loglevel.ldap" value="DEBUG" />
    <variable name="idp.loglevel.messages" value="DEBUG" />
    <variable name="idp.loglevel.encryption" value="DEBUG" />
    <variable name="idp.loglevel.opensaml" value="DEBUG" />
    <variable name="idp.loglevel.props" value="DEBUG" />

 I see no entry at all after invoking the resolver exerciser, whether for
problematic user with no SAML output or my own id with 143 lines of SAML
shown.


> -- Scott
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230307/ae785adb/attachment.htm>