Event logs
All of the operational applications will have the capability of generating functional events. These events are all added to an event queue, and are then handled by a listener.
For an initial concept, the listener has a very straightforward duty: it will dispatch the events to a selected workflow. A different workflow can be selected for each event type.
The configuration of the Auditing Events can be done from the admin portal > Auditing tab.
Event Overview
Event Type | Description |
---|---|
Authentication Events | Authentication events are triggered each time a user successfully or unsuccessfully authenticates, using any Identity Provider configured in TrustBuilder. |
Authorization Events | Authorization events are triggered each time a user successfully or unsuccessfully tries to access any Service Provider configured in TrustBuilder. |
Log-out events | The Log-out events are generated when a users logs-out. |
Session Events | Creates an event every time a session is updated. |
Administration Events | Creates an event for administration actions. |
Format
The events are passed in a JSON-like format to the selected workflow. Date and time are represented in the epoch format. The data for each of the events is described in the Event Type pages, which are linked in the table above.
Auditing Configuration
From the Admin Portal, go to Auditing > Event Handling. This page allows you to configure which auditing events are handled by which workflow.
Events are generated and put on an Event Queue. There is a listener that will process all these events, and dispatch them to the appropriate workflow.
Field | Description |
---|---|
Event Type | Describes to which event types the application will listen. |
Workflow Handler | Select which workflow will handles events of this type. |
Enabled | Can be toggled to enable or disable listening to a specific event type |
Batch | Can be toggled to group multiple events of the same type into a batch. More information below. For environments with a lot of traffic, it could be desirable not to kick off a new workflow with each event. For these circumstances, we've added the possibility to group the events into batches, so they can be handled more efficiently, while remaining available in near real-time. Currently the settings are set as follows:
|
Events types
Authentication events
Trigger | Event Code |
Authentication Succeeded | ORCH-1010 |
Authentication Failed | ORCH-1020 |
Data | |
|
Authorization events
There are two types of Authorization Events that correspond to the policies that can be set on the Service Provider pages.
Authentication Rules (coarse grained)
Authorization Rules (fine grained)
Authentication Rules | |
---|---|
Trigger | Event Code |
Authorization Allowed | ORCH-2010 |
Authorization Denied | ORCH-2020 |
Step-up | ORCH-2030 |
Reauthenticate | ORCH-2040 |
Data | |
|
Application Rules | |
---|---|
Trigger | Event Code |
Allow | ORCH-2110 |
Deny | ORCH-2120 |
Step-up | ORCH-2130 |
Reauthenticate | ORCH-2140 |
Data | |
|
Log-out events
Trigger | Event Code |
INITIAL_LOGOUT_REQUEST | ORCH-3010 |
INTERMEDIATE_LOGOUT_REQUEST | ORCH-3110 |
INTERMEDIATE_LOGOUT_SUCCESSFUL | ORCH-3210 |
INTERMEDIATE_LOGOUT_PARTIALLY_SUCCESSFUL | ORCH-3220 |
INTERMEDIATE_LOGOUT_FAILED | ORCH-3230 |
COMPLETE_LOGOUT_SUCCESSFUL | ORCH-3310 |
COMPLETE_LOGOUT_PARTIALLY_SUCCESSFUL | ORCH-3320 |
Data | |
|
Session events
Trigger | Event Code |
SESSION_UPDATE | ORCH-4000 |
Data | |
|
Administration events
Admin access
Administration Access | |
---|---|
Trigger | Event Code |
Successful Administrator login | ADMN-1010 |
Administrator logged out | ADMN-1020 |
Failed Administration login | ADMN-1030 |
Json | |
|
User changes
Configuration Change | |
---|---|
Trigger | Event Code |
Configuration Object Created | ADMN-3010 |
Configuration Object Updated | ADMN-3020 |
Configuration Object Deleted | ADMN-3030 |
Json | |
|
User CRUD event | |
---|---|
Trigger | Event Code |
User Created | USER-1010 |
User Edited | USER-1020 |
User Removed | USER-1030 |
Json | |
|
Config Change Events
Configuration Change | |
---|---|
Trigger | Event Code |
Configuration Object Created | ADMN-4010 |
Configuration Object Updated | ADMN-4020 |
Configuration Object Deleted | ADMN-4030 |
Json | |
|
Server Events
Server Restart | |
---|---|
Trigger | Event Code |
Server stopped | ADMN-2010 |
Server started | ADMN-2020 |
Json | |
|