IBM_SECURITY_TRUST events

This event type is generated by the trust server when it validates a token, issues a token, maps an identity, or authorizes a Web service call.

The following table lists the elements that can be shown in the output of an IBM_SECURITY_TRUST event.

--> -->

Element	Description
accessDecision	For the authorization module, it is the result of the authorization decision. This element is filled out only when the action is authorized.The XPath is: CommonBaseEvent/extendedDataElements [@name='accessDecision']/values
action	The action being performed. Possible actions are: authorize issue map validate The XPath is: CommonBaseEvent/extendedDataElements [@name='action']/values
appliesTo	The destination or resource the request or token applies to.The XPath is: CommonBaseEvent/extendedDataElements [@name='appliesTo']/values
issuer	Party responsible for issuing the token.The XPath is: CommonBaseEvent/extendedDataElements [@name='issuer']/values
moduleName	The module in the STS module chain the action is taken on.The XPath is: CommonBaseEvent/extendedDataElements [@name='moduleName']/values
ruleName	The rule name used for the mapping module. This element is filled out only when specified action is set to map. The XPath is: CommonBaseEvent/extendedDataElements [@name='ruleName']/values
token	The incoming token the action is being taken on. Only the first 1024 characters of the token are set. When the action is set to map, this element represents the incoming principal.The XPath is: CommonBaseEvent/extendedDataElements [@name='token']/values
tokenInfo	The internal representation of the user information after changes are made by the module. Only the first 1024 characters of the token are set. When action is set to map, this element represents the outgoing principal. When the action is set to authorize, this element represents the principal for whom the access decision was made.The XPath is: CommonBaseEvent/extendedDataElements [@name='tokenInfo']/values
tokenType	The type of token the module is using.The XPath is: CommonBaseEvent/extendedDataElements [@name='tokenType']/values

Samples of IBM_SECURITY_TRUST events

The following example shows an event generated by a Trust request.

<CommonBaseEvent creationTime="2013-07-19T06:21:05.256Z" 
extensionName="IBM_SECURITY_TRUST" 
globalInstanceId="FIMf596c16e013f12d38eb0b66d4d925" 
sequenceNumber="1" version="1.1">
	<contextDataElements name="Security Event Factory" 
type="eventTrailId">
		<contextId>FIM_f596bda0013f188f9983b66d4d92542a+971185751</contextId>
	</contextDataElements>
	<extendedDataElements name="tokenType" type="string">
		<values>Not Available</values>
	</extendedDataElements>
	<extendedDataElements name="issuer" type="string">
		<values>/otpfed/otp/get/delivery/options/issuer</values>
	</extendedDataElements>
	<extendedDataElements name="token" type="string">
		<values>user1 [ Attribute 1 name   [ value 1 user1 ] ]</values>
	</extendedDataElements>
	<extendedDataElements name="ruleName" type="string">
		<values>otp_get_methods.js </values>
	</extendedDataElements>
	<extendedDataElements name="moduleName" type="string">
		<values>com.tivoli.am.fim.trustserver.sts.modules.STSMapDefault</values>
	</extendedDataElements>
	<extendedDataElements name="appliesTo" type="string">
		<values>/otpfed/otp/get/delivery/options/appliesto</values>
	</extendedDataElements>
	<extendedDataElements name="action" type="string">
		<values>Map</values>
	</extendedDataElements>
	<extendedDataElements name="tokenInfo" type="string">
		<values>user1 [ Attribute 1 name   [ value 1 user1 ] ]</values>
	</extendedDataElements>
	<extendedDataElements name="outcome" type="noValue">
		<children name="result" type="string">
			<values>SUCCESSFUL</values>
		</children>
		<children name="majorStatus" type="int">
			<values>0</values>
		</children>
	</extendedDataElements>
	<sourceComponentId application="IBM Security Verify Access" 
component="Authentication and Federated Identity" 
componentIdType="ProductName" 
executionEnvironment="Linux[amd64]#2.6.32-279.14.1.30.iss7_3.x86_64" 
location="localhost" locationType="FQHostname" 
subComponent="com.tivoli.am.fim.trustserver.sts.modules.STSMapDefault" 
threadId="Default Executor-thread-6" 
componentType="http://www.ibm.com/namespaces/autonomic/Tivoli_componentTypes"/>
	<situation categoryName="ReportSituation">
		<situationType xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="ReportSituation" reasoningScope="INTERNAL" reportCategory="SECURITY"/>
	</situation>
</CommonBaseEvent>

Parent topic: Audit Advanced Access Control