Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: rm ? from headings

...

Table of Contents
maxLevel5
minLevel3

Who and how am I

...

Code Block
languagebash
titleWhat IDP version is currently installed
$ /opt/shibboleth-idp/bin/version.sh
3.4.6

...

See IDP 3 Updates for detailed instructions.

What's happening right now

...

Code Block
languagebash
titleWatch IDP und Webserver logs
multitail -f /opt/shibboleth-idp/logs/idp-process.log /var/log/tomcat9/access.log

...

Code Block
languagebash
titleTrail all relevant logs at once
multitail -f /opt/shibboleth-idp/logs/idp-process.log /var/log/tomcat9/access.log -l 'journalctl -u tomcat9.service -f'

Who logged in and where, with what attributes sent

...

Code Block
languagebash
titleAudit log
multitail -f /opt/shibboleth-idp/logs/idp-audit.log

...

Code Block
languagebash
titleHTTP User-Agent IP address in audit and access log
fgrep 192.168.1.99 /opt/shibboleth-idp/logs/idp-audit.log /var/log/tomcat9/access.log

What data will go out for userid X to service Y

...

The aacli is a very useful tool to test what data the running IDP would send for a given subject (replace SOME_USERID below with the login name the subject would enter during authentication) to a given SP. Not only does that help verifying your attribute resolver  and attribute filter configuration when you're making changes to either (or both), it can also be useful in debugging access problems someone experiences at a given SP as you can easily compare what data would go out for different subjects (e.g. in cases where access works vs. where it fails) without needing the subject's cooperation in this issue (or access to their password).

...