How To: Generate SAML Logs on the IdP

Version Affected: 9.0+

 

Overview

This article explains how to turn on server-side SAML tracing for a SecureAuth Identity Provider (IdP) realm, so the realm writes the authentication requests and Security Assertion Markup Language (SAML) assertions it sends and receives to a text log file. This is useful when a client-side SAML tracer, such as the SAML Tracer add-on for Firefox, is not practical to use, and it also captures what the realm receives at its Assertion Consumer Service (ACS) when the realm is acting as the Service Provider (SP) for another identity provider.

Enable SAML Tracing on the Realm

1. Back up the realm's web.config file, then open the Admin Console for the realm.
2. Go to the realm's System Info tab.
3. If the realm is on SecureAuth IdP 9.2 or earlier, click Click to edit Web Config file. If the realm is on IdP 9.3 or later, first decrypt the web.config from the System tab, then open the decrypted file in a text editor.
4. Scroll to the end of the web.config in the Web Config Editor and paste the following block just above the closing </configuration> tag:

<system.diagnostics>
  <trace autoflush="true">
    <listeners>
      <add name="TextWriter"/>
    </listeners>
  </trace>
  <sources>
    <source name="ComponentSpace.SAML2" switchValue="Verbose">
      <listeners>
        <add name="TextWriter"/>
      </listeners>
    </source>
  </sources>
  <sharedListeners>
    <add name="TextWriter"
         type="System.Diagnostics.TextWriterTraceListener"
         initializeData="idp.log"/>
  </sharedListeners>
</system.diagnostics>

5. Click Save.

This generates a log file named idp.log in the realm's folder on the appliance — for example, D:\SecureAuth\Secureauth10\idp.log. Replace the drive, folder, and realm names with the actual path on your appliance.

Special Considerations

SAML tracing writes verbose data to the log continuously once it's enabled. When you are finished troubleshooting, remove this block from the web.config to disable tracing again — leaving it enabled indefinitely will eventually fill the appliance's disk.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.