Only log passwords on debug level, but not INFO

• Key: DIRSERVER-660
• Type: Bug
• Status: Closed
• Resolution: Fixed
• Priority: Major
• Assignee: Unassigned
• Reporter: Ralf Hauser
• Component/s: ldap

Description

So far, I have not configured apacheDS logging and I always see

33768450 [IoThreadPool-1] INFO org.apache.directory.server.ldap.LdapProtocolProvider$LdapProtocolHandler - [/127.0.0.1:34100] RECEIVED: BindRequest
        Version : '3'
        Name : 'dn=[e-mail]'
        Simple authentication : '111111/0x31 0x31 0x31 0x31 0x31 0x31 '

While in a development environment, it is ok to log this, in a production environment it is not. I guess quite some production environments use the default, i.e. INFO

furthermore, http://www.slf4j.org/docs.html is not particularly helpful how to change this...

Comments

[Ralf Hauser]

I also reported the lack of hints how to configure the logging to slf4j http://bugzilla.slf4j.org/show_bug.cgi?id=25

I looked at my log4j.properties and it does not have any appender for org.apache.directory, so I guess it is not found or apacheDS has its own config file somewhere?

if so, shouldn't this be described somewhere in http://directory.apache.org/subprojects/apacheds/docs/users/index.html ?

see also DIRSERVER-486 and DIRMINA-114

[Emmanuel Lecharny]

It's funny, because I committed the fix yesturday night, in the next RC4 release. (if you want to test it, just check out this branch :
svn co http://svn.apache.org/repos/asf/directory/branches/apacheds/optimization-trunks

The log you have is not controlled by a log4j configuration file. It should be fixed in a way. I will keep the DIRSERVER-486 open until we find a good solution to this problem.