<html><body><div dir="ltr">
<br>
</div>
<br>
<div class="gmail_quote" dir="ltr">
<div dir="ltr" class="gmail_attr">On Mar 6, 2023 at 17:29:19, "Cantor, Scott" <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br></div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" type="cite">
<div>
<div>
The audit log logs released attributes, it does not log encoded ones. Adding the SAML encoding option means you're seeing what can be encoded, and that's not the same.<br></div></div></blockquote><div class="gmail_quote"><br></div>So to elaborate for my clarity, that means</div><div class="gmail_quote" dir="ltr"><ul style="margin:0px;list-style-type:"\002013 "" dir="ltr"><li>presence of attribute name(s) in audit log indicates those attributes were “OK’d” by release policies<br></li><li>presumably (yes?) that entails those attributes had values (not null) or they wouldn’t have been checked against release policies<br></li><li>but somehow encoders for those attributes were not triggered - at least when running the resolver exerciser</li></ul><div><br></div><div dir="ltr">I realize that in principle an attribute could be populated and released by policy but not be encoded, but I’m seeing even the most ‘basic’ of attributes with encoders in their definitions (ePPN, uid, …) show up in audit log by name, but not in the resolver exerciser (maybe related to the puzzle of no process log entries for the resolver exerciser). I’ve tried the resolver exerciser with an attribute reflector SP - for most users, lots of lines in the attribute statement saml, but for the problematic ones, no attribute statement at all. I hadn’t noticed previously, but there’s no SAML at all: no issuer or subject as well as no attribute statement.</div><div dir="ltr"><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" type="cite"><div><div><br><blockquote type="cite">...why doesn’t the resolver test trigger log entries in ids-process.log ? [err, idp-process.log]</blockquote><br>It does.<br></div></div></blockquote><div class="gmail_quote" dir="ltr"><br></div><div class="gmail_quote" dir="ltr">Is there a specific logger I need to include in the logback config to see them? With the current knobs all at “DEBUG” in my standby:</div><pre style="border:1px solid rgb(206,206,206);background-color:rgb(244,244,244);padding:10px;border-radius:2px;margin-top:0px;margin-bottom:0px"><span style="font-size:11px"> <!-- Logging level shortcuts. --><br> <variable name="idp.loglevel.idp" value="DEBUG" /><br> <variable name="idp.loglevel.ldap" value="DEBUG" /><br> <variable name="idp.loglevel.messages" value="DEBUG" /><br> <variable name="idp.loglevel.encryption" value="DEBUG" /><br> <variable name="idp.loglevel.opensaml" value="DEBUG" /><br> <variable name="idp.loglevel.props" value="DEBUG" /></span></pre><div class="gmail_quote" dir="ltr"> I see no entry at all after invoking the resolver exerciser, whether for problematic user with no SAML output or my own id with 143 lines of SAML shown.</div><br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" type="cite"><div><div><br>-- Scott<br><br>
</div>
</div>
</blockquote>
</div></body></html>