<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="en-VN" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="mso-margin-top-alt:0cm;margin-right:0cm;margin-bottom:12.0pt;margin-left:36.0pt">
<b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of Peter Schober <peter.schober@univie.ac.at><br>
<b>Date: </b>Friday, 2 July 2021 at 15:03<br>
<b>To: </b>users@shibboleth.net <users@shibboleth.net><br>
<b>Subject: </b>Re: Sending the SAMLReply/Assertion<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">* Jan Vilhuber <JVilhuber@absolute.com> [2021-07-02 04:05]:<br>
> I’m trying to figure out how I can gather usage metrics from<br>
> shibboleth SP<br>
<br>
The transaction log should cover "usage metrics" use cases just fine<br>
(always provided you do the parsing and convertion into time series<br>
data yourself).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-US">What I’m specifically looking for is things like which hashing and encryption algorithms (and hopefully which certificate was used, i.e. things like SP subject-name and serial number) were used (and by whom). The purpose
is to find out who I need to alert that they may need to update their settings to more secure algorithms or move to a new cert (in certificate rollover scenarios). I haven’t found any way to get this info into the transaction log.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><br>
> 1. Process signature debug logs and turn them into metrics (then discarding them, as they contain sensitive information), or<br>
> 2. Sending the SAMLReply or Assertion to some endpoint when it is received (after processing and validation), so some other service can turn it into metrics.<br>
> Is there some way I can send the raw reply or at least the Assertion to an API? Or perhaps turn the whole thing into an HTTP header and forward it along with the attributes it normally sends?<br>
<br>
Why would you need signature debug logs <o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">This is where crypto algorithm and certificate information can be gleaned.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt">(and why would there be<br>
sensitive information in them?) <o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">Since we’re dumping assertions, user attributes can be seen, which contain PII.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Another idea: Is there an SP API (Soap or otherwise) where I might be able to get the saml assertion from the SP given a session Index?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Jan<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt">or raw assertions for "usage metrics"?<br>
<br>
-peter<br>
-- <br>
For Consortium Member technical support, see <a href="https://urldefense.com/v3/__https:/wiki.shibboleth.net/confluence/x/coFAAg__;!!GEjU_1jlQXGQfQ!3mu6PuXWRYuv385iD9dy2ew9ml57DW_pwuUiiAVV0hS_ipi31dK0l60uROZlSRUVug$">
https://urldefense.com/v3/__https://wiki.shibboleth.net/confluence/x/coFAAg__;!!GEjU_1jlQXGQfQ!3mu6PuXWRYuv385iD9dy2ew9ml57DW_pwuUiiAVV0hS_ipi31dK0l60uROZlSRUVug$</a>
<br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<o:p></o:p></p>
</div>
</div>
</body>
</html>