Skip to content

Improve debugging of authproc configuration - AttributeDump authproc#2601

Open
nathanjrobertson wants to merge 3 commits intosimplesamlphp:simplesamlphp-2.5from
nathanjrobertson:authproc_attributedump
Open

Improve debugging of authproc configuration - AttributeDump authproc#2601
nathanjrobertson wants to merge 3 commits intosimplesamlphp:simplesamlphp-2.5from
nathanjrobertson:authproc_attributedump

Conversation

@nathanjrobertson
Copy link
Contributor

This PR implements an authproc which dumps attributes to the SimpleSAMLphp logs. By default, it will output all attributes, but this can be refined by either specifying attribute names or regular expressions to match attribute names.

This is intended to help server administrators debug whilst developing configuration of their authprocs. Being able to insert an AttributeDump into the list of filters is invaluable to finding "where did that value come from?".

The base case implemented dumps out all attributes present at the current position in the authproc filter list:

    'authproc' => [
        49 => [
            'class' => 'core:AttributeAdd',
            [...]
        ],

        50 => [
            'class' => 'core:AttributeDump',
            'prefix' => 'After running AttributeAdd but before applying AttributeLimit filter',
        ],

        51 => [
            'class' => 'core:AttributeLimit',
            [...]
        ],
    ],

You can optionally specify a list of attributes to output (attributes), or a list of regular expressions of the attributes you want to output (attributesRegex). If either or both of those are specified, the list of attributes outputted to the log files is trimmed to only those which match the given criteria.

Included is documentation and phpunit tests.

Please note, in the PHPunit test class in order to test the value of the outputted log message it uses the deprecated SimpleSAML\TestUtils\ArrayLogger, copying the way SimpleSAML\Test\Module\core\Controller\ExceptionTest works. I can only see one use case of the replacement / newer SimpleTestLogger in the saml2 project, and both cases take the $logger as a parameter to the function. I don't think it's a drop in replacement, which is probably why ExceptionTest stays with the deprecated ArrayLogger. Anyway, happy to take feedback on what the preferred way to go with this one is.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant