<div dir="ltr">







<p class="">Apologies in advance if I'm misunderstanding the request; here are examples of what I log:</p><p class=""><span class="">Bare fact of failed LDAP authN at INFO level:</span></p><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class="">INFO</span><span class=""> </span><span class="">[edu.vt.middleware.ldap.jaas.JaasAuthenticator:180]</span><span class=""> </span><span class="">-</span><span class=""> </span><span class="">Authentication</span><span class=""> </span><span class="">failed</span><span class=""> </span><span class="">for</span><span class=""> </span><span class="">dn:</span><span class=""> </span><span class="">uid=••••••,dc=alaska,dc=edu</span></blockquote><p class=""><span class="">Further details (LDAP error message) at DEBUG level:</span></p>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class="">DEBUG</span><span class=""> </span><span class="">[edu.vt.middleware.ldap.jaas.LdapLoginModule:136]</span><span class=""> </span><span class="">-</span><span class=""> </span><span class="">Authentication</span><span class=""> </span><span class="">failed<br></span><span class="">javax.naming.AuthenticationException:</span><span class=""> </span><span class="">[LDAP:</span><span class=""> </span><span class="">error</span><span class=""> </span><span class="">code</span><span class=""> </span><span class="">49</span><span class=""> </span><span class="">-</span><span class=""> </span><span class="">Invalid</span><span class=""> </span><span class="">Credentials]</span></blockquote><div><br></div><div>David Bantz</div><div>U Alaska </div>
</div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jan 21, 2016 at 1:47 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">> What I'm trying to do is to log at the IDP when the user enters a username<br>
> and password that does not succeed.  Elsewhere on the lists it mentioned<br>
> greping for "failed" in the idp.process log (if I remember right).  I need to<br>
> watch for brute force attacks, among other things.<br>
<br>
</span>And I'm just telling you that the old IdP doesn't do that, only the underlying authentication components do.<br>
<br>
If you want to *know* the situation, you go to the actual back-end. LDAP, Kerberos, AD, whatever. Their logs are the ones you really want.<br>
<br>
If you want to get the answer on the IdP side in V2, you are relying on the libraries that are calling those back-ends, and that's not a single answer. If you're doing LDAP with the provided code, that's the vt-ldap code, so that is the logging you're looking for, you just used the wrong category I guess. I don't know the correct one offhand, but I log all of the vt-ldap categories on INFO, and I don't think you'll find that very noisy.<br>
<div class="HOEnZb"><div class="h5"><br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>