Shibboleth Developers

[Scott Cantor <>]

Snipped for brevity, but I take your point. ;-)

We have a pretty simple way to build a basic audit log, since each session
has a much shorter identifier attached to it (the encrypted handles most
origins use are huge (that thing you had at the end).

All we really need is to have a record when the session starts, various key
life cycle events, and so forth, labeled with the cookie value. The new
model for application configuration in 1.2 provides more useful context for
the session.

What I'm not sure we can do easily is tie that effectively to real
application events on your side of the fence, but maybe that's not a
requirement.

In any case, we probably also need to improve the logs more generally, but
we probably want to keep the real audit logging distinct like the origin
did.

-- Scott