Dev debuglog

[chakl]

various improvements:

• make log level configurable from config-exsaml.xml
• do not store SAML request ids unless needed
• remove console:log()
• doc clarifications

[chakl]

I believe the custom logging logic introduced with $exsaml:logdebug is for convenience, right?

Actually, it was introduced to stop people editing the module code, just because they want to see a certain log message. They can now enable "debug mode" and see all log messages from this module, including more detailed debug log messages that are not logged in normal operation. Debug mode is for debugging the module's operation. It should not be enabled in normal setups.

This is controlled by the config-exsaml.xml:/config/@debug attribute. false (default) means standard logging, true means verbose debug logging.

But you could argue that changing the level of these log entries should require a restart because it would log sensitive data. What is your though on this?

• the module must not log sensitive persistent data (passwords, secrets). It may log sensitive volatile data (SAML assertions) when in debug mode
• debug mode is for developers and admins, who can access sensitive data anyway

[joewiz]

@chakl @line-o Is this PR good to go?