NULLs in idp.process.log with LDAP authn against ActiveDirectory

Problem: grep doesn't like the idp-process.log.

This confused me because the file should not be binary. After some investigation, I found NULLs in the file and grep flags the file binary; it can find matches, but won't report them because the matches might include binary data (... won't report unless you supply --binary-files=text.) The message is presented if (1) the pattern matches somewhere and (2) the file includes NULLs; it does NOT require that the matches contain NULLs. If no line matches, grep does not complain; it exits silently without any output (though $? == 1).

We see frequent authn exceptions in our idp-process.log that include a NULL character. It's part of an authn exception report from org.ldaptive.auth when authenticating against an Active Directory service. The error, 52e, is "invalid credentials" [1], so it's no surprise that the report is common. The NULL is in the following serialization:

The caret-@ is a NULL in the log file.

I think it's appropriate to remove this NULL from the logging. Is that reasonable to the devs?

[I suppose grep should also be able to report matches if no match includes binary data. But that's S.E.P.]

Thanks for your time,

Paul
–
Paul Fardy
Shib Admin, Info Security, University of Toronto

Sample log text:

[1] https://www-01.ibm.com/support/docview.wss?uid=swg21290631
  "52e - invalid credentials"