IBM_SECURITY_AUTHN_events

This event type is generated by the authentication service when it authenticates a user accessing a protected resource. The following table lists the elements that can be shown in the output of an IBM_SECURITY_AUTHN event. All elements are included in the output, unless indicated otherwise.

Element	Description
action	Optionally specifies the HTTP method on the requested resource or the operation that is performed by the provider of the authentication service.The XPath is: CommonBaseEvent/extendedDataElements [@name='action']/values
authnProvider	Provider of the authentication service. Sample data: com.tivoli.am.fim.authsvc.protocol.delegate.AuthSvcDelegate com.tivoli.am.fim.authsvc.action.authenticator.hotp.HOTPAuthnticator The XPath is: CommonBaseEvent/extendedDataElements [@name='authnProvider']/values
authnScope	Optionally specifies the transaction identifier of the authentication policy. Sample data: 94434b2a-748e-42fe-af3d-67db04aa4ba0 The XPath is: CommonBaseEvent/extendedDataElements [@name='authnScope']/values
authnType	The URI identifier of the authentication policy. Sample data: urn:ibm:security:authentication:asf:password_hotp The XPath is: CommonBaseEvent/extendedDataElements [@name='authnType']/values
partner	The authentication service does not utilize this element and will appear in the IBM_SECURITY_AUTHN event as ‘Not Available’.The XPath is: CommonBaseEvent/extendedDataElements [@name='partner']/values
progName	Optionally specifies the URL of the requested resource. Sample data: http://www.example.com The XPath is: CommonBaseEvent/extendedDataElements [@name='progName']/values
tokenType	The authentication service does not utilize this element and will appear in the IBM_SECURITY_AUTHN event as ‘Not Available’.The XPath is: CommonBaseEvent/extendedDataElements [@name='tokenType']/values
trustRelationship	The authentication service does not utilize this element and will appear in the IBM_SECURITY_AUTHN event as 'Not Available’.The XPath is: CommonBaseEvent/extendedDataElements [@name='trustRelationship']/values
userInfo.appUserName	Optionally specifies information about the user who is authenticating.The XPath is: CommonBaseEvent/extendedDataElements [@name='userInfoList']/children[1]/children [@name='appUserName']/values
userInfo.attributes	Optionally specifies the following types of additional information about user data audited during authentication: licenseFileMetadata Metadata that is defined in the license agreement. licenseFileName The license file name. userAction The action the user takes when the End-User License Agreement authentication mechanism presents the license agreement. The user can accept the license agreement or decline the license agreement. The XPath is: CommonBaseEvent/extendedDataElements [@name='userInfoList']/children [@name='userInfo'] /children [@name='attributes']/children
xmlTokenType	The authentication service does not utilize this element and will appear in the IBM_SECURITY_AUTHN event as ‘Not Available’.The XPath is: CommonBaseEvent/extendedDataElements [@name='xmlTokenType']/values

Sample of an IBM_SECURITY_AUTHN event

The following example shows one event generated by the runtime for a two-factor authentication policy requiring both username password and one-time password authentications:

<CommonBaseEvent
  creationTime="2014-02-15T18:50:05.026Z"
  extensionName="IBM_SECURITY_AUTHN"
  globalInstanceId="FIM36e24f6301441708947ceef443526"
  sequenceNumber="2"
  version="1.1">
  <contextDataElements
    name="Security Event Factory"
    type="eventTrailId">
        <contextId>FIM_36e24f62014415f59913eef443526e68+1246005647</contextId>
  </contextDataElements>
  <extendedDataElements name="userInfoList" type="noValue">
   <children name="userInfo" type="noValue">
     <children name="registryUserName" type="string">
       <values>Not Available</values>
     </children>
     <children name="appUserName" type="string">
       <values>test_user</values>
     </children>
   </children>
 </extendedDataElements>
 <extendedDataElements name="tokenType" type="string">
   <values>Not Available</values>
 </extendedDataElements>
 <extendedDataElements name="authnProvider" type="string">
   <values>com.tivoli.am.fim.authsvc.action.authenticator.hotp.HOTPAuthenticator</values>
 </extendedDataElements>
 <extendedDataElements name="action" type="string">
      <values>verify</values>
 </extendedDataElements>
 <extendedDataElements name="authnType" type="string">
      <values>urn:ibm:security:authentication:asf:password_hotp</values>
 </extendedDataElements>
 <extendedDataElements name="outcome" type="noValue">
      <children name="result" type="string">
        <values>SUCCESSFUL</values>
      </children>
      <children name="majorStatus" type="int">
        <values>0</values>
      </children>
 </extendedDataElements>
 <extendedDataElements name="trustRelationship" type="string">
      <values>Not Available</values>
 </extendedDataElements>
 <extendedDataElements name="progName" type="string">
      <values>Not Available</values>
 </extendedDataElements>
 <extendedDataElements name="authnScope" type="string">
      <values>Not Available</values>
 </extendedDataElements>
 <sourceComponentId
      application="IBM Security Verify Access"
      component="Authentication and Federated Identity"
      componentIdType="ProductName"
      executionEnvironment="Linux[amd64]#2.6.32-279.14.1.30.iss7_3.x86_64"
      location="example"
      locationType="FQHostname"
      subComponent="com.tivoli.am.fim.authsvc.action.authenticator.hotp.HOTPAuthenticator"
      threadId="Default Executor-thread-60"
      componentType="http://www.ibm.com/namespaces/autonomic/Tivoli_componentTypes"/>
  <situation categoryName="ReportSituation"> 
     <situationType
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:type="ReportSituation"
       reasoningScope="INTERNAL"
       reportCategory="SECURITY"/>
  </situation>
</CommonBaseEvent>

Parent topic: Audit Federation