{"type":"doc","content":[{"type":"paragraph","content":[{"text":"File(s):","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"conf/audit.xml, conf/errors.xml, conf/logback.xml, conf/authn/authn.properties","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"Format:","type":"text","marks":[{"type":"strong"}]},{"text":" Native Spring, ","type":"text"},{"text":"Logback","type":"text","marks":[{"type":"link","attrs":{"href":"http://logback.qos.ch/manual/index.html"}}]}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"3"}},"macroMetadata":{"macroId":{"value":"95ac583c-7418-42cb-aad7-6f4f7d178af3"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"92229b25-c1b8-45fc-9ff8-fd0e954df456"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"The audit logging feature provides a detailed record of every transaction handled by the IdP to allow tracing of user activity, statistical analysis of usage, legal record keeping, etc. It is highly extensible, allowing the format to be customized, selection of fields to log on a per-profile basis, and the addition of custom audit fields using additional Java code or scriptlets without modifying core code in most cases. Unlike the diagnostic logs, the audit log is meant to be machine-readable.","type":"text"}]},{"type":"paragraph","content":[{"text":"The primary audit stream deals with the request/response profile handling of the IdP itself (this also includes logging the requests and responses associated with the ","type":"text"},{"text":"SAML proxying support","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP5/pages/3199505973"}}]},{"text":"). This is routed by default through a logger named \"Shibboleth-Audit\" to a file called ","type":"text"},{"text":"idp-audit.log","type":"text","marks":[{"type":"em"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Another audit record stream exists for logging decisions made by users regarding ","type":"text"},{"text":"attribute release and terms of use","type":"text","marks":[{"type":"link","attrs":{"href":"#"}}]},{"text":" acceptance and is routed by default through a logger named \"Shibboleth-Consent-Audit\" to a file called ","type":"text"},{"text":"idp-consent-audit.log","type":"text","marks":[{"type":"em"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"There is also separate stream of authentication audit events for each supported login flow. By default this feature is not enabled, but if done, these records appear in the same audit stream as the primary auditing. It is straightforward (and usually advisable) to route these records by category to a separate file or destination since the record format is not the same as the primary records.","type":"text"}]},{"type":"paragraph","content":[{"text":"Finally, the primary audit log supports the ability to create multiple log records in different formats or with different fields at the same time for the same events (and optionally route them to different categories for output to different destinations). The authentication auditing does not support this feature for simplicity (and because of the relative paucity of fields).","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"General Configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"As with the diagnostic logs, the actual logging is handled by the Logback implementation and so the portion of configuration that deals with how the logs are written and managed is in the ","type":"text"},{"text":"conf/logback.xml","type":"text","marks":[{"type":"em"}]},{"text":" file through the manipulation of the two ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" elements and related content for the \"Shibboleth-Audit\" and \"Shibboleth-Consent-Audit\" categories.","type":"text"}]},{"type":"paragraph","content":[{"text":"However, there is minimal formatting applied there, just direct output of the audit message. The configuration of the audit format(s) to use for particular transactions is handled separately, in ","type":"text"},{"text":"conf/audit.xml","type":"text","marks":[{"type":"em"}]},{"text":", to allow customizing of the audit fields themselves, using formatting tokens that are themselves configured within the IdP and are extensible. You can think of it like a second logging abstraction on top of the underlying one to avoid reliance on Logback-specific extensions.","type":"text"}]},{"type":"paragraph","content":[{"text":"There are really two halves to the auditing system: field extraction and log output. While suitable defaults are provided, both halves can be changed using ","type":"text"},{"text":"conf/audit.xml","type":"text","marks":[{"type":"em"}]},{"text":" (or ","type":"text"},{"text":"conf/intercept/consent-intercept-config.xml","type":"text","marks":[{"type":"em"}]},{"text":" for the “Shibboleth-Consent-Audit” category). Extending field extraction typically requires additional Java code or scripts to pull new data out of the request state and make it available to the log output stage, but there are a lot of built-in fields.","type":"text"}]},{"type":"expand","attrs":{"title":"Field Extraction"},"content":[{"type":"paragraph","content":[{"text":"Field extraction is the process of populating a labeled field in an ","type":"text"},{"text":"AuditContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-profile.cgi/net.shibboleth.profile.context.AuditContext"}}]},{"text":" object that is built up over the life of a transaction. The context is just a map of field names to collections of values and the field names are just conventions built-in to the software to provide a standard set of useful fields to audit.","type":"text"}]},{"type":"paragraph","content":[{"text":"Fields are extracted at various points through the life of a transaction so that adequate detail can be exposed about the request, the processing of the request, and the response. These extraction points are associated with collections of field extraction beans that do the actual work to pull data out of the state of the transaction and store it for output.","type":"text"}]},{"type":"paragraph","content":[{"text":"The built-in extraction points and beans are as follows (empty beans are not provided to reduce clutter, but you can add them, per the example below):","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.FlowStartAuditExtractors","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Extractors that run immediately after the flow starts operating and the ability to add fields is possible","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.PostDecodeAuditExtractors","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Extractors focused on the input message, runs after decoding the input message","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.PostLookupAuditExtractors","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Runs after establishing the sender's identity, supplements the input side with information about the relying party","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.PostAssertionAuditExtractors","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Extractors focused on authentication, session, and attribute information, runs after those processes and after the initial creation of the outgoing assertion (if relevant to the request)","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.PostResponseAuditExtractors","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Extractors focused on the outgoing message, runs after construction of the message","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.LogoutRequestAuditExtractors","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Extractors focused on information specific to a SAML LogoutRequest message, runs after decoding of the message","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.LogoutAuditExtractors","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Extractors focused on information in a non-SAML logout","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.ErrorViewAuditExtractors","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Extracts subject, session, and attribute information, runs in the event that a local error is generated","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.consent.PreConsentAuditExtractors","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Extracts basic information about the consent step, runs before a decision is made","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Empty map beans are declared in ","type":"text"},{"text":"conf/intercept/consent-intercept-config.xml","type":"text","marks":[{"type":"em"}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.consent.ConsentAuditExtractors","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Extracts information about the decision, runs after a decision is made","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Empty map beans are declared in ","type":"text"},{"text":"conf/intercept/consent-intercept-config.xml","type":"text","marks":[{"type":"em"}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.PostRequestAuditExtractors","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Extractors for an AuthnRequest built for proxied SAML SSO","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.PostInboundResponseAuditExtractors","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Extractors for a Response from proxied SAML SSO","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.PostInboundAssertionAuditExtractors","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Extractors for Assertions from proxied SAML SSO","type":"text"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"Each entry in these maps is a key containing the string label to associate (the name of the field), and a value containing a ","type":"text"},{"text":"Function","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Function"}}]},{"text":"<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":",Object> instance. Functions can return either single objects that get converted to a string for logging, or a Collection of objects that are converted to strings and separated by commas within the logged field.","type":"text"}]},{"type":"paragraph","content":[{"text":"In this manner, you can add your own fields by implementing a function (or writing a script) to return any data you can find in the context tree and associating it with a custom field label by adding it to one of the maps named above.","type":"text"}]},{"type":"paragraph","content":[{"text":"A similar extractor map exists for each login flow in the IdP, allowing different auditing behavior per-flow. All these beans have names based on the underlying login flow (e.g. ","type":"text"},{"text":"shibboleth.authn.Password.AuditExtractors","type":"text","marks":[{"type":"strong"}]},{"text":", etc.)","type":"text"}]}]},{"type":"expand","attrs":{"title":"Custom Field Examples"},"content":[{"type":"paragraph","content":[{"text":"A skeletal example follows to demonstrate how to create a map to contain a custom field extraction rule:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Adding custom fields to the audit log via audit.xml","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\n\t\n\t\t\n \n\t\t\n\t\n","type":"text"}]},{"type":"paragraph","content":[{"text":"A real world example: if you're logging fields containing a URL, you may need to escape characters in a URL because of the delimiter you choose to use in the log format. You can do this using a script:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Encoding 'pipe' character appearing in CAS service URLs","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":" \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n ","type":"text"}]},{"type":"paragraph","content":[{"text":"A rather more convoluted example is to dump the values or arbitrary attributes into the log. To do this we define an abstract bean to emit the attribute values (in an arbitrary format) for any attribute (most of this is really error and null handling):","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Output Attribute Values","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\t\n\t\t\n\t \n\t \n\t \n\t \n\t","type":"text"}]},{"type":"paragraph","content":[{"text":"Then a bean to emit a specific attribute can be easily created:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"","type":"text"}]}]},{"type":"expand","attrs":{"title":"Built-in Generic Fields"},"content":[{"type":"paragraph","content":[{"text":"The generic fields that are supported out of the box are as follows (note that not every field is always populated; that depends on the timing of errors and the specific transaction being audited):","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"5666c6bd-029e-43ef-b3bc-ac9350ab1634"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"Field","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[1085.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"ST","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1085.0]},"content":[{"type":"paragraph","content":[{"text":"Timestamp for start of flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"T","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1085.0]},"content":[{"type":"paragraph","content":[{"text":"Timestamp event is recorded","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"e","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1085.0]},"content":[{"type":"paragraph","content":[{"text":"WebFlow Event","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"URL","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1085.0]},"content":[{"type":"paragraph","content":[{"text":"URL","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"URI","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1085.0]},"content":[{"type":"paragraph","content":[{"text":"URI","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"DEST","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1085.0]},"content":[{"type":"paragraph","content":[{"text":"Destination URL of outgoing msg","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"s","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1085.0]},"content":[{"type":"paragraph","content":[{"text":"IdP session ID","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"HASHEDs","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1085.0]},"content":[{"type":"paragraph","content":[{"text":"Hashed IdP session ID","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"AF","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1085.0]},"content":[{"type":"paragraph","content":[{"text":"Authentication flow ID","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"SSO","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1085.0]},"content":[{"type":"paragraph","content":[{"text":"SSO flag","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"a","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1085.0]},"content":[{"type":"paragraph","content":[{"text":"Client address","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"UA","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1085.0]},"content":[{"type":"paragraph","content":[{"text":"User agent string","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"P","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1085.0]},"content":[{"type":"paragraph","content":[{"text":"Profile ID","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"u","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1085.0]},"content":[{"type":"paragraph","content":[{"text":"Username","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"HASHEDu","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1085.0]},"content":[{"type":"paragraph","content":[{"text":"Hashed username","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"uu","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1085.0]},"content":[{"type":"paragraph","content":[{"text":"Impersonating","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP5/pages/3199510036"}}]},{"text":" username","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"attr","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1085.0]},"content":[{"type":"paragraph","content":[{"text":"Attribute(s)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"ROP","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1085.0]},"content":[{"type":"paragraph","content":[{"text":"Requested authentication operator","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"RPRIN","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1085.0]},"content":[{"type":"paragraph","content":[{"text":"Requested authentication principals","type":"text"}]}]}]}]}]},{"type":"expand","attrs":{"title":"Built-in SAML Fields"},"content":[{"type":"paragraph","content":[{"text":"The more SAML-oriented fields that are supported out of the box are as follows (note that not every field is always populated; that depends on the timing of errors and the specific transaction being audited):","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"49447ba9-b7d2-41b0-bac4-c20948d62160"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"Field","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"SP","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"Service provider name","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"IDP","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"Identity provider name","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"p","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"Protocol","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"b","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"Inbound binding","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"bb","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"Outbound binding","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"RS","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"RelayState","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"n","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"NameID value","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"f","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"NameID format","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"SPQ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"NameID SPNameQualifier","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"pf","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"NameIDPolicy required format","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"PSPQ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"NameIDPolicy required SPNameQualifier","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"i","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"Assertion ID","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"d","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"Assertion timestamp","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"I","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"Inbound message ID","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"D","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"Inbound message timestamp","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"II","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"InResponseTo","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"III","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"Outbound message ID","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"DD","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"Outbound message timestamp","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"t","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"AuthenticationInstant","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"x","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"SessionIndex","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"ac","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"AuthenticationContext","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"S","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"Status code","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"SS","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"Sub-status code","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"SM","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"Status message","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"pasv","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"IsPassive","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"fauth","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"ForceAuthn","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"SCC","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"Scoping ProxyCount from an AuthnRequest","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"SCI","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"Scoping IdP list from an AuthnRequest","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"SCR","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"Scoping Requester ID(s) from an AuthnRequest","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"PRC","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"ProxyRestriction ProxyCount","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"PRA","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"ProxyRestriction Audiences","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"XX","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"Signed inbound messages","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"X","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"Encrypted assertions","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[225.0]},"content":[{"type":"paragraph","content":[{"text":"XA","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1088.0]},"content":[{"type":"paragraph","content":[{"text":"Encryption algorithm","type":"text"}]}]}]}]}]},{"type":"expand","attrs":{"title":"Built-in Authentication FIelds"},"content":[{"type":"paragraph","content":[{"text":"A few fields are defined for auditing specific information during authentication; many are specific to particular login flows. Note that the Duo fields are for the built-in Duo flow; the newer plugin has a larger set of fields documented on the ","type":"text"},{"text":"DuoOIDC configuration page","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/x/twDmUQ"}}]},{"text":".","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"5a69a245-d6c6-465e-8666-c8b24fff2801"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":".Field","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[1086.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"tu","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1086.0]},"content":[{"type":"paragraph","content":[{"text":"Transformed username submitted for validation (Password flow only)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"AR","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1086.0]},"content":[{"type":"paragraph","content":[{"text":"Results of authentication attempt, either “Success” or classified error strings","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"CV","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1086.0]},"content":[{"type":"paragraph","content":[{"text":"Specific CredentialValidator bean used (Password flow only)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"X509S","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1086.0]},"content":[{"type":"paragraph","content":[{"text":"Certificate subject (X.509 flows only)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"X509I","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1086.0]},"content":[{"type":"paragraph","content":[{"text":"Certificate issuer (X.509 flows only)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"DuoCID","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1086.0]},"content":[{"type":"paragraph","content":[{"text":"Duo client identifier/integration key (Duo flow only)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"DuoF","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1086.0]},"content":[{"type":"paragraph","content":[{"text":"Duo factor (Duo flow only)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"DuoDID","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1086.0]},"content":[{"type":"paragraph","content":[{"text":"Duo device ID (Duo flow only)","type":"text"}]}]}]}]}]},{"type":"expand","attrs":{"title":"Audit Log Output"},"content":[{"type":"paragraph","content":[{"text":"In the output stage, a bean named ","type":"text"},{"text":"shibboleth.AuditFormattingMap","type":"text","marks":[{"type":"strong"}]},{"text":" is used to write any number of log records containing any fields you configure to the logging API, at which point the Logback configuration takes over and decides how to send that data to particular log files or other log sinks. The bean is a map between logging categories and formatting strings.","type":"text"}]},{"type":"paragraph","content":[{"text":"The consent audit log relies on its own properties and beans to provide an audit format, so refer to that ","type":"text"},{"text":"documentation","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP5/pages/3199509862"}}]},{"text":" for those specifics.","type":"text"}]},{"type":"paragraph","content":[{"text":"Formatting strings contain fields denoted with a '%' character followed by a field label, and any whitespace or punctuation terminates a field label and is included in the record directly. Using '%%' will output a single percent character.","type":"text"}]},{"type":"paragraph","content":[{"text":"An additional bean, ","type":"text"},{"text":"shibboleth.AuditSuppressedProfiles,","type":"text","marks":[{"type":"strong"}]},{"text":" contains a list of profile identifiers that should ","type":"text"},{"text":"not","type":"text","marks":[{"type":"strong"}]},{"text":" result in audit log records. The default list is used to exempt the \"status\" handler from being logged. A partial list of profile IDs can be found in the ","type":"text"},{"text":"MetadataDrivenConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP5/pages/3199508127"}}]},{"text":" topic.","type":"text"}]},{"type":"paragraph","content":[{"text":"Finally, when errors are handled \"locally\" (see ","type":"text"},{"text":"ErrorHandlingConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP5/pages/3199506653"}}]},{"text":"), the IdP can be told whether to output an audit log record or not when the error event occurs. This is useful to suppress logging noise when common errors occur that would lead to a lot of useless auditing. The flag controlling this is inside the ","type":"text"},{"text":"shibboleth.LocalEventMap","type":"text","marks":[{"type":"strong"}]},{"text":" bean in ","type":"text"},{"text":"conf/errors.xml","type":"text","marks":[{"type":"em"}]},{"text":" (the value of each map entry is the flag indicating whether to log).","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Reference","type":"text"}]},{"type":"expand","attrs":{"title":"Beans"},"content":[{"type":"paragraph","content":[{"text":"General beans defined in ","type":"text"},{"text":"audit.xml","type":"text","marks":[{"type":"em"}]},{"text":", ","type":"text"},{"text":"errors.xml","type":"text","marks":[{"type":"em"}]},{"text":", and related system configuration are:","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"6c728928-322b-446c-851b-992d072ccabd"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[401.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[704.0]},"content":[{"type":"paragraph","content":[{"text":"Function","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[401.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.AuditFormattingMap","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"Map","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[704.0]},"content":[{"type":"paragraph","content":[{"text":"Map of logging categories to audit formatting strings for general audit logging","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[401.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.AuditDateTimeFormat","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[704.0]},"content":[{"type":"paragraph","content":[{"text":"DateTimeFormat string to apply to DateTime fields (but does ","type":"text"},{"text":"not","type":"text","marks":[{"type":"strong"}]},{"text":" apply to the logback-generated field at the beginning of the log line)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[401.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.AuditDefaultTimeZone","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[704.0]},"content":[{"type":"paragraph","content":[{"text":"Whether to convert DateTime fields into the machine's default time zone (UTC is used otherwise)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[401.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.AuditFieldReplacementMap","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"Map","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[704.0]},"content":[{"type":"paragraph","content":[{"text":"Map of replacement strings to substitute in when populating audit fields (simple way to shrink long constants down to size)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[401.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.AuditSuppressedProfiles","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"List","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[704.0]},"content":[{"type":"paragraph","content":[{"text":"List of profiles to skip auditing","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[401.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.LocalEventMap","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"Map","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[704.0]},"content":[{"type":"paragraph","content":[{"text":"Map of local error events to flags indicating whether to output an audit log record","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[401.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.SuppressedEvents","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"List","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[704.0]},"content":[{"type":"paragraph","content":[{"text":"List of events that should not be logged as \"errors\" by the process log (generally leaving them to the audit log)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[401.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.DefaultSuppressedEvents","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"List","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[704.0]},"content":[{"type":"paragraph","content":[{"text":"Default list of events used in place of shibboleth.SuppressedEvents bean","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"In addition, there are a set of standard beans containing the map of field extractors for all of the various \"interception points\" of the processing of the IdP. A pair of beans are reserved for each point, a default set that comes out of the box, and a defined bean ID to override or add to those defaults. Each of these beans is of type ","type":"text"},{"text":"Map","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Map"}}]},{"text":"<","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String"}}]},{"text":",","type":"text"},{"text":"Function","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Function"}}]},{"text":"<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org/opensaml/profile/context/ProfileRequestContext"}}]},{"text":",Object>>","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.FlowStartAuditExtractors /","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"shibboleth.DefaultFlowStartAuditExtractors","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.PostDecodeAuditExtractors / shibboleth.DefaultPostDecodeAuditExtractors","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.PostLookupAuditExtractors / shibboleth.DefaultPostLookupAuditExtractors","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.PostAssertionAuditExtractors / shibboleth.DefaultPostAssertionAuditExtractors","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.PostResponseAuditExtractors / shibboleth.DefaultPostResponseAuditExtractors","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.PostRequestAuditExtractors / shibboleth.DefaultPostRequestAuditExtractors","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.PostInboundResponseAuditExtractors / shibboleth.DefaultPostInboundResponseAuditExtractors","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.PostInboundAssertionAuditExtractors / shibboleth.DefaultPostInboundAssertionAuditExtractors","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.LogoutRequestAuditExtractors / shibboleth.DefaultLogoutRequestAuditExtractors","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.LogoutAuditExtractors / shibboleth.DefaultLogoutAuditExtractors","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.ErrorViewAuditExtractors / shibboleth.DefaultErrorViewAuditExtractors","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.consent.PreConsentAuditExtractors / shibboleth.consent.DefaultPreConsentAuditExtractors","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.consent.ConsentAuditExtractors / shibboleth.consent.DefaultConsentAuditExtractors","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"paragraph","content":[{"text":"An additional set of beans for each login flow are also defined:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.Password.AuditExtractors / shibboleth.authn.Password.DefaultAuditExtractors","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"etc.","type":"text"}]}]}]}]},{"type":"expand","attrs":{"title":"Properties"},"content":[{"type":"paragraph","content":[{"text":"Properties are defined in ","type":"text"},{"text":"services.properties","type":"text","marks":[{"type":"em"}]},{"text":" to customize various aspects of audit logging:","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"5989e564-bb0d-4906-9d9b-bf2ac7ea4776"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[329.0]},"content":[{"type":"paragraph","content":[{"text":"Property","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[114.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[595.0]},"content":[{"type":"paragraph","content":[{"text":"Function","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[329.0]},"content":[{"type":"paragraph","content":[{"text":"idp.service.logging.saml1sso","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[114.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"SSO","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":12,"colwidth":[595.0]},"content":[{"type":"paragraph"},{"type":"paragraph"},{"type":"paragraph"},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Suffix added to audit logging category when various profiles/flows are audited, you can use this to route different kinds of audit records to different destinations based on general function","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[329.0]},"content":[{"type":"paragraph","content":[{"text":"idp.service.logging.saml1attrquery","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[114.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"AttributeQuery","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[329.0]},"content":[{"type":"paragraph","content":[{"text":"idp.service.logging.saml1artifact","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[114.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"ArtifactResolution","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[329.0]},"content":[{"type":"paragraph","content":[{"text":"idp.service.logging.saml2sso","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[114.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"SSO","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[329.0]},"content":[{"type":"paragraph","content":[{"text":"idp.service.logging.saml2attrquery","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[114.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"AttributeQuery","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[329.0]},"content":[{"type":"paragraph","content":[{"text":"idp.service.logging.saml2artifact","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[114.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"ArtifactResolution","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[329.0]},"content":[{"type":"paragraph","content":[{"text":"idp.service.logging.saml2slo","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[114.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"Logout","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[329.0]},"content":[{"type":"paragraph","content":[{"text":"idp.service.logging.logout","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[114.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"Logout","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[329.0]},"content":[{"type":"paragraph","content":[{"text":"idp.service.logging.cas","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[114.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"SSO","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[329.0]},"content":[{"type":"paragraph","content":[{"text":"idp.service.logging.status","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[114.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"Status","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[329.0]},"content":[{"type":"paragraph","content":[{"text":"idp.service.logging.resolvertest","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[114.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"ResolverTest","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[329.0]},"content":[{"type":"paragraph","content":[{"text":"idp.service.logging.serviceReload","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[114.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"Reload","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[329.0]},"content":[{"type":"paragraph","content":[{"text":"idp.audit.shortenBindings","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[114.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[595.0]},"content":[{"type":"paragraph","content":[{"text":"Allows simpler \"short names\" of SAML bindings and other (configurable) constants to appear in the audit log, instead of full URIs","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[329.0]},"content":[{"type":"paragraph","content":[{"text":"idp.audit.hashAlgorithm","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[114.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"SHA-256","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[595.0]},"content":[{"type":"paragraph","content":[{"text":"Hash algorithm to apply to various hashed fields","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[329.0]},"content":[{"type":"paragraph","content":[{"text":"idp.audit.salt","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[114.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[595.0]},"content":[{"type":"paragraph","content":[{"text":"Salt to apply to hashed fields, must be set to use those fields","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Additional properties are housed in authn/authn.properties to enable and customize authentication auditing. The token in the various property names below is a stand-in for the actual login flow suffix (Password, External, RemoteUser, etc.), as these are per-flow properties.","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"2acbb71d-15b6-4714-a343-c209001e5c75"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"Property","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[519.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.audit.enabled","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[519.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"Enables the authentication audit logging feature","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn..audit.enabled","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[519.0]},"content":[{"type":"paragraph","content":[{"text":"%{idp.authn.audit.enabled}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"Enables audit logging for a specific login flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn..audit.category","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[519.0]},"content":[{"type":"paragraph","content":[{"text":"Shibboleth-Audit.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"Log category for audit records for a specific login flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.audit.format","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[519.0]},"content":[{"type":"paragraph","content":[{"text":"%a|%T|%SP|%I|%s|%AF|%CV|%u|%tu|%AR|%UA","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"Audit formatting string for this login flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Duo.audit.format","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[519.0]},"content":[{"type":"paragraph","content":[{"text":"%a|%T|%SP|%I|%s|%AF|%u|%AR|%DuoCID|%DuoF|%DuoDID|%UA","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"Audit formatting string for this login flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.External.audit.format","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[519.0]},"content":[{"type":"paragraph","content":[{"text":"%a|%T|%SP|%I|%s|%AF|%u|%AR|%UA","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"Audit formatting string for this login flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Function.audit.format","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[519.0]},"content":[{"type":"paragraph","content":[{"text":"%a|%T|%SP|%I|%s|%AF|%u|%AR|%UA","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"Audit formatting string for this login flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.IPAddress.audit.format","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[519.0]},"content":[{"type":"paragraph","content":[{"text":"%a|%T|%SP|%I|%s|%AF|%CV|%u|%AR|%UA","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"Audit formatting string for this login flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.RemoteUser.audit.format","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[519.0]},"content":[{"type":"paragraph","content":[{"text":"%a|%T|%SP|%I|%s|%AF|%CV|%u|%AR|%UA","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"Audit formatting string for this login flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.RemoteUserInternal.audit.format","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[519.0]},"content":[{"type":"paragraph","content":[{"text":"%a|%T|%SP|%I|%s|%AF|%CV|%u|%AR|%UA","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"Audit formatting string for this login flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.SPNEGO.audit.format","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[519.0]},"content":[{"type":"paragraph","content":[{"text":"%a|%T|%SP|%I|%s|%AF|%u|%AR|%UA","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"Audit formatting string for this login flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.X509.audit.format","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[519.0]},"content":[{"type":"paragraph","content":[{"text":"%a|%T|%SP|%I|%s|%AF|%X509S|%X509I|%AR|%UA","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"Audit formatting string for this login flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.X509Internal.audit.format","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[519.0]},"content":[{"type":"paragraph","content":[{"text":"%a|%T|%SP|%I|%s|%AF|%X509S|%X509I|%AR|%UA","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"Audit formatting string for this login flow","type":"text"}]}]}]}]}]},{"type":"paragraph"},{"type":"paragraph"}],"version":1}

Browser not supported