PII

By default, we do not include any potential PII (personally identifiable information) in our exceptions in order to be in compliance with GDPR.

If you need to see the full information present in exceptions, please set IdentityModelEventSource.ShowPII to true.

IdentityModelEventSource.ShowPII = true;

Avoid logging the signatures from JWS and authentication tag from JWE when PII is on.

By default, the logger will not log the complete token for security purposes.

How we log the disarmed token:

1. For SecurityToken: A new interface is introduced: Microsoft.IdentityModel.Logging.ISafeLogSecurityArtifact with a single method UnsafeToString(). SecurityToken will implementations (JsonWebToken, JwtSecurityToken,SAML, etc.) the interface and will provide an implementation of UnsafeToString() to return the complete encoded token.

NOTE: The ToString() method is used for return the encoded token without signature or authentication tag.

2. For type of object that is not able modified (such as ‘string’): Struct SecurityArtifact can be used to wrap the object and provide a callback to Log appropriately.

How to use the wrapper:

LogHelper.MarkAsSecurityArtifact(EncodedToken, ToString callback)

If you need to log the complete token in logs when ShowPII is set to true, please setIdentityModelEventSource.LogCompleteSecurityArtifact to true.

IdentityModelEventSource.LogCompleteSecurityArtifact = true;