Logging

MSAL for Java uses the Simple Logging Facade for Java (SLF4J) to abstract the logging framework. SLF4J serves as a simple facade or abstraction for various logging frameworks, such as java.util.logging, logback and log4j. SLF4J allows the end-user to plug in the desired logging framework at deployment time.

For instructions on how to bind to various logging frameworks, reference the SLF4J manual.

For a simple example, logback is one logging frameworks you could use. To import logback into your application, you would add the logback dependency to your .pom file:

        <dependency>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-classic</artifactId>
            <version>1.2.3</version>
        </dependency>

You will also need to create a logback configuration file called logback.xml and place it in a folder in your classpath so logback can find it. There are too many configuration options to list here, however here is an example logback.xml that should print all of MSAL Java's debug logs:

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE configuration>

<configuration>
  <import class="ch.qos.logback.classic.encoder.PatternLayoutEncoder"/>
  <import class="ch.qos.logback.core.ConsoleAppender"/>

  <appender name="STDOUT" class="ConsoleAppender">
    <encoder class="PatternLayoutEncoder">
      <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
    </encoder>
  </appender>

  <root level="debug">
    <appender-ref ref="STDOUT"/>
  </root>
</configuration>

SLF4J should automatically bind to logback at deployment time, and if so you will see MSAL logs being written to console.

Personal Identifiable Information (PII) & Organizational Identifiable Information (OII)

By default, MSAL logging does not capture or log any PII or OII. The library allows app developers to turn this on by configuring logPii on the client application builder. By turning on PII or OII, the app takes responsibility for safely handling highly-sensitive data and complying with any regulatory requirements.

PII or OII logging disabled. Default Logger does not capture any PII or OII

    PublicClientApplication app2 = PublicClientApplication.builder(PUBLIC_CLIENT_ID)
            .authority(AUTHORITY)
            .build();

PII or OII logging enabled

    PublicClientApplication app2 = PublicClientApplication.builder(PUBLIC_CLIENT_ID)
            .authority(AUTHORITY)
            .logPii(true)
            .build();