Monitoring attributes per IdP

[baszoetekouw]

We would like to keep records of which attributes are given out per IdP. So we would like to get an overview like this:

- idp: https://entityid.example.com/
  num_authentications: 1200
  attributes:
    - uid: 1199
    - schacHomeOrg: 1200
    - displayName: 1167
    - mail: 999
    - edupersonAffiliation: 321
    - isMemberOf: 2

meaning that that total number of authentication from this service was 1200, all authentications had schacHome in the assertion, 1 was missing a uid (which caused an error, obviously), 999 had a mail address, etc.

Note that we thus not only want to count successful logins, but also errors (as long a valid assertion was received).

I don't think that EB needs to aggregate the statistics to the form as specified here; logging a proper line per login that can be processed offline probably suffices.

[thijskh]

It is already possible to log attributes through the auth.log.attributes: [] option in parameters.yml, which might be helpful to achieve your goal.

[baszoetekouw]

@thijskh looking at the code, that also seems to log the attribute values, right? For this feature, we would like to have this info being gather continuously for all IdPs, and I'd rather not log all attribute values for all authentications on the platform.