obtaining more granular AWS Cognito App information in shib logs?

[Morgan, Andrew J]

Could something be added to the SP metadata (stored with Shibboleth) that would then appear in the logs?  During the SSO integration steps, could the IDP operator add some human-friendly name to the metadata?

Thanks,
Andy

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Peter Schober via users <users at shibboleth.net>
Sent: Thursday, September 26, 2024 5:58 AM
To: users at shibboleth.net <users at shibboleth.net>
Cc: Peter Schober <peter.schober at univie.ac.at>
Subject: Re: obtaining more granular AWS Cognito App information in shib logs?

[This email originated from outside of OSU. Use caution with links and attachments.]

Arron Merrill via users <users at shibboleth.net> [2024-09-26 13:41 CEST]:
> We would like this specific information so that we can feed it into our
> SIEM to enable us to more quickly determine which services users are
> accessing. The Cognito apps remain obfuscated and we are trying to get them
> in line with the rest of our integrations.

How about the referer (sic) header, then, as found in your IDP's web
server's log files?
Depending on how you correlate requests/responses you may not need to
pull that information into your IDP audit logs (assuming that's
possible it's probably not advisable, given that they're
client-controlled).

-peter
--
For Consortium Member technical support, see https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C02%7Cmorgan%40oregonstate.edu%7C091b5cce74464f4348ab08dcde2af4c6%7Cce6d05e13c5e4d6287a84c4a2713c113%7C0%7C0%7C638629523312386951%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=SspOlpc%2BiXLxXA8L2jEp4a8ciBGTwhikNzAdrkAnh8I%3D&reserved=0<https://shibboleth.atlassian.net/wiki/x/ZYEpPw>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240926/8abbf860/attachment.htm>