Shibboleth Developers

[Noah Levitt <>]

Hello shib-dev,

I'd like to propose a change to the way logging is
configured in the shibboleth origin. This proposal stems
from discussions with Walter.

log4j.properties is complicated. Users shouldn't need to
understand it. This fact became abundantly clear as we tried
to configure the new transaction log. We encountered some
difficulties getting the logging statements to appear in the
transaction log and not in the error log.

I suggest a section like the following in origin.xml:

  <Logging>
    <ErrorLogLevel>WARN</ErrorLogLevel>  <!-- DEBUG, INFO, WARN, ERROR or 
FATAL -->
    
<ErrorLogLocation>file:///var/log/shibboleth/origin-error.log</ErrorLogLocation>
    
<TransactionLogLocation>file:///var/log/shibboleth/origin-access.log</TranslactionLogLocation>
  </Logging>

The whole section is optional, as is each element
individually. If unspecified:

  ErrorLogLevel: WARN
  ErrorLogLocation: the error log goes to stdout
  TransactionLogLocation: none

log4j.properties goes away. LogServ.java looks at origin.xml
and configures log4j accordingly. ErrorLogLocation and
TransactionLogLocation take a url, for consistency.
Supplying a url that is not a file:/// results in a fatal
error at startup.

I don't think we should make any effort to accomodate
unusual configurations. Anything that the new origin.xml
tags can't handle can be done in code fairly simply. We can
figure out what to do for users who require more complicated
configurations if we ever hear from any. Even if we do, I
would be extremely hesitant to add more options.

Comments? Should I start working on this?

Noah