24 Enabling Debugging for SAML 1.1 and 2.0

1. If you have not already done so, in the Change Center of the WebLogic Server Administration Console, click Lock & Edit (see Use the Change Center).
2. In the left pane of the console, expand Environment and select Servers.
3. On the Summary of Servers page, click the server on which you want to enable or disable debugging to open the settings page for that server.
4. Click Debug.
5. Expand weblogic.
6. Expand security.
7. Enable SAML debugging as follows:

   • To enable the SAML 1.1 debug scope, which encompasses all the SAML 1.1 attributes, select saml, then click Enable.

   • To enable one or more individual SAML 1.1 debug attributes, expand saml, expand the scope of the desired attribute, select the desired individual SAML 1.1 attribute, then click Enable. For example, expand saml, expand atn, and select the DebugSecuritySAMLAtn attribute to debug SAML 1.0 authentication processing.

   • To enable the SAML 2.0 debug scope, which encompasses all the SAML 2.0 attributes, select saml2, then click Enable.

   • To enable one or more individual SAML 2.0 debug attributes, expand saml2, expand the scope of the desired attribute, select the desired individual SAML 2.0 attribute, then click Enable. For example, expand saml2, expand credmap, and select the DebugSecuritySAML2Credmap attribute to debug SAML 2.0 credential mapping provider processing.

   For a description of each registered SAML debug attribute, see About SAML Debug Scopes and Attributes.

8. To activate these changes, in the Change Center of the WebLogic Server Administration Console, click Activate Changes (see Use the Change Center).

You can use the WebLogic Scripting Tool (WLST) to configure SAML debugging attributes. For example, the following command runs a program for setting debugging attributes called debug.py:

java weblogic.WLST debug.py

The debug.py program contains the following code, which enables debugging for the attribute DebugSecuritySAMLAtn.

user='user1'
password='password'
url='t3://localhost:7001'
connect(user, password, url)
edit()
cd('Servers/myserver/ServerDebug/myserver')
startEdit()
set('DebugSecuritySAMLAtn','true')
save()
activate()

Note that you can also use WLST from Java. The following example shows the source file of a Java program that sets the DebugSecuritySAMLAtn debugging attribute:

import weblogic.management.scripting.utils.WLSTInterpreter;
import java.io.*;
import weblogic.jndi.Environment;
import javax.naming.Context;
import javax.naming.InitialContext;
import javax.naming.NamingException;

public class test {
        public static void main(String args[]) {
       try {
              WLSTInterpreter interpreter = null;
              String user="user1";
              String pass="pw12ab";
              String url ="t3://localhost:7001";
              Environment env = new Environment();
              env.setProviderUrl(url);
              env.setSecurityPrincipal(user);
              env.setSecurityCredentials(pass);
              Context ctx = env.getInitialContext();

              interpreter = new WLSTInterpreter();
              interpreter.exec
                     ("connect('"+user+"','"+pass+"','"+url+"')");
              interpreter.exec("edit()");
              interpreter.exec("startEdit()");
              interpreter.exec
                     ("cd('Servers/myserver/ServerDebug/myserver')");
              interpreter.exec("set('DebugSecuritySAMLAtn','true')");       
              interpreter.exec("save()");
              interpreter.exec("activate()");

       } catch (Exception e) {
       System.out.println("Exception "+e);
       }
       }
}

Using the WLST is a dynamic method and can be used to enable debugging while the server is running.

Messages corresponding to enabled debug attributes are sent to the server log file. Optionally, you can also send debug messages to standard out by passing the StdoutSeverity=Debug attribute on the LogMBean in the command to start WebLogic Server. For example, -Dweblogic.log.StdoutSeverity=Debug.

For more information, see Message Output and Logging in Command Reference for Oracle WebLogic Server.