IBM_SECURITY_MGMT_POLICY events

This event type is generated by federation runtime management calls. An IBM_SECURITY_MGMT_POLICY event is generated by the following actions:

• When a new federation is created.
• When an existing federation is modified.
• When a federation is deleted.
• When a partner is added to a federation.
• When a partner is deleted from a federation.
• When the properties of a partner are modified.
• When a Web Service partner is created.
• When a Web Service partner is modified.

The following table lists the elements that can be shown in the output of an IBM_SECURITY_MGMT_POLICY event.

Element	Description
action	The type of operation being performed. The supported operations are: create delete modify The XPath is: CommonBaseEvent/extendedDataElements [@name='action']/values
mgmtInfo.command	Information about the management operation. The supported management operations are: CreateFederation ModifyFederation DeleteFederation CreateFederationPartner ModifyFederationPartner DeleteFederationPartner CreateWebServicePartner ModifyWebServicePartner Modifying or deleting a Web service partner generates a ModifyWebServicePartner operation. The XPath is: CommonBaseEvent/extendedDataElements [@name='mgmtInfo']/children [@name='command']/values
policyInfo.attributes	The different attributes for this policyInfo object. See the tables in Attributes determined by policy profile type for attributes that might be present in the event. Each attribute consists of a name and a value. The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='value']/values
policyInfo.name	The name of the federation, the name of the partner, or the name of the Web service partner.The XPath is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='name']/values
policyInfo.type	Information about the policy object. The type can be either federation or partner.The XPath is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='type']/values
userInfo.appUserName	Information about the user who is performing this operation.The XPath is: CommonBaseEvent/extendedDataElements [@name='userInfoList']/children[1]/children [@name='appUserName']/values

Attributes determined by policy profile type

Depending on the type of profile used, policyInfo contains different attributes. These attributes can be shredded or extracted for custom reports. Different partner attributes are specified as partner id_attribute name, where partner id is the uuid assigned to a partner and attribute name is an attribute from the following tables.

Shredding and staging attributes

This example shows how the data can be shredded using the contains keyword. It requires an XPath for each attribute.

To stage the following name-value pairs for FederationName, FederationId and SAML1.SigningKey Identifier from the attributes fields of a policyInfo, use the following XPaths:

Field	XPath
policyInfo.attributes FederationId	CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'FederationId')]
policyInfo.attributes FederationId value	CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'FederationId')] /../../children [@name='value']/values
policyInfo.attributes FederationName	CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'FederationName')]
policyInfo.attributes FederationName value	CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'FederationName')] /../../children [@name='value']/values
policyInfo.attributes SAML1.SigningKeyIdentifier	CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML1.SigningKeyIdentifier')]
policyInfo.attributes SAML1.SigningKeyIdentifier value	CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML1.SigningKeyIdentifier')] /../../children [@name='value']/values

SAML20 self attributes

The following table lists the SAML20 self attributes audited in profiles for service providers and identity providers.

Common attributes for service providers and identity providers	Definitions
SAML2.SigningKeyIdentifier	The identifier for the key used to sign outgoing messages.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SigningKeyIdentifier')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SigningKeyIdentifier')] /../../children [@name='value']/values
SAML2.DecryptionKeyIdentifier	Pointer to the private key used to decrypt the symmetric encryption key in encrypted messages from a partner.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.DecryptionKeyIdentifier')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.DecryptionKeyIdentifier')] /../../children [@name='value']/values
SAML2.EncryptionKeyTransportAlgorithm	The algorithm used to encrypt the symmetric encryption key.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.EncryptionKeyTransportAlgorithm)] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.EncryptionKeyTransportAlgorithm')] /../../children [@name='value']/values
SAML2.SignArtifactRequest	The indicator for Whether the provider signs outgoing artifact requests.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SignArtifactRequest')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SignArtifactRequest')] /../../children [@name='value']/values
SAML2.SignArtifactResponse	The indicator for Whether the provider signs outgoing artifact responses.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SignArtifactResponse')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SignArtifactResponse')] /../../children [@name='value']/values
SAML2.SignLogoutRequest	The indicator for Whether the provider signs outgoing logout requests.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SignLogoutRequest')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SignLogoutRequest')] /../../children [@name='value']/values
SAML2.SignLogoutResponse	The indicator for Whether the provider signs outgoing logout responses.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SignLogoutResponse')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SignLogoutResponse')] /../../children [@name='value']/values
SAML2.SignNameIDManagementRequest	The indicator for Whether the provider signs outgoing name identifier management requests.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SignNameIDManagementRequest')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SignNameIDManagementRequest')] /../../children [@name='value']/values
SAML2.SignNameIDManagementResponse	The indicator for Whether the provider signs outgoing name identifier management responses.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SignNameIDManagementResponse')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SignNameIDManagementResponse')] /../../children [@name='value']/values
SAML2.PresentFederationConsent	The indicator for Whether the identity provider presents a consent to federate page when the federation occurs.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.PresentFederationConsent')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.PresentFederationConsent')] /../../children [@name='value']/values
Additional self attributes for service providers only
SAML2.SignAuthnRequest	The indicator for Whether the provider signs outgoing authentication requests.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SignAuthnRequest')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SignAuthnRequest')] /../../children [@name='value']/values
SAML2.WantAssertionsSigned	The indicator for Whether the provider wants to receive signed assertions.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.WantAssertionsSigned')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.WantAssertionsSigned')] /../../children [@name='value']/values
Additional self attributes for identity providers only
SAML2.ValidateAuthnRequest	The indicator for Whether the provider validates incoming authentication requests.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.ValidateAuthnRequest')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.ValidateAuthnRequest')] /../../children [@name='value']/values
SAML2.SignAuthnResponse	The indicator for Whether the provider signs authentication responses.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SignAuthnResponse')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SignAuthnResponse')] /../../children [@name='value']/values

SAML20 partner attributes

The following table lists the SAML20 partner attributes audited in profiles for service providers and identity providers.

Common attributes for service providers and identity providers	Definitions
SAML2.SoapRequestClientBasicAuth	The indicator for Whether client basic authentication is used for the SOAP backchannels.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SoapRequestClientBasicAuth')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SoapRequestClientBasicAuth')] /../../children [@name='value']/values
SAML2.SoapRequestClientCertAuth	The indicator for Whether client certificate authentication is used for the SOAP backchannels.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SoapRequestClientCertAuth')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SoapRequestClientCertAuth')] /../../children [@name='value']/values
SAML2.SoapRequestServerCertAuth	The indicator for Whether server certificate authentication is used for the SOAP backchannels.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SoapRequestServerCertAuth')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SoapRequestServerCertAuth')] /../../children [@name='value']/values
SAML2. SoapRequestServerCertAuthKeyIdentifier	The identifier for the key used when using server certificate authentication.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SoapRequestServerCertAuthKeyIdentifier')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SoapRequestServerCertAuthKeyIdentifier')] /../../children [@name='value']/values
SAML2. SoapRequestClientCertAuthKeyIdentifier	The identifier for the key used when using client certificate authentication.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SoapRequestClientCertAuthKeyIdentifier')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SoapRequestClientCertAuthKeyIdentifier')] /../../children [@name='value']/values
SAML2.ValidateKeyIdentifier	The identifier for the key used to validate signatures on incoming messages from a partner. This attribute is the signing public key of the partner.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.ValidateKeyIdentifier)] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.ValidateKeyIdentifier')] /../../children [@name='value']/values
SAML2.EncryptionKeyIdentifier	The identifier for the key used to encrypt outgoing messages to a partner. This attribute is the encrypting public key of the partner.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.EncryptionKeyIdentifier')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.EncryptionKeyIdentifier')] /../../children [@name='value']/values
SAML2.ValidateArtifactRequest	The indicator for Whether the provider validates incoming artifact requests.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.ValidateArtifactRequest')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.ValidateArtifactRequest')] /../../children [@name='value']/values
SAML2.ValidateArtifactResponse	The indicator for Whether the provider validates incoming artifact responses.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.ValidateArtifactResponse')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.ValidateArtifactResponse')] /../../children [@name='value']/values
SAML2.ValidateLogoutRequest	The indicator for Whether the provider validates incoming logout requests.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.ValidateLogoutRequest')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.ValidateLogoutRequest')] /../../children [@name='value']/values
SAML2.ValidateLogoutResponse	The indicator for Whether the provider validates incoming logout responses.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.ValidateLogoutResponse')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.ValidateLogoutResponse')] /../../children [@name='value']/values
SAML2. ValidateNameIDManagementRequest	The indicator for Whether the provider validates incoming name identifier management requests.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.ValidateNameIDManagementRequest')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.ValidateNameIDManagementRequest')] /../../children [@name='value']/values
SAML2. ValidateNameIDManagementResponse	The indicator for Whether the provider validates incoming name identifier management responses.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.ValidateNameIDManagementResponse')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.ValidateNameIDManagementResponse')] /../../children [@name='value']/values
SAML2.EncryptNameIdentifiers	The indicator for Whether name identifiers must be encrypted for the partner.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.EncryptNameIdentifiers')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.EncryptNameIdentifiers)] /../../children [@name='value']/values
SAML2.BlockEncryptionAlgorithm	The algorithm used to encrypt the data.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.BlockEncryptionAlgorithm')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.BlockEncryptionAlgorithm')] /../../children [@name='value']/values
Additional partner attributes for service providers only
SAML2.WantAssertionsSigned	The indicator for Whether the provider wants to receive signed assertions.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.WantAssertionsSigned')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.WantAssertionsSigned')] /../../children [@name='value']/values
Additional partner attributes for identity providers only
SAML2.SignAssertions	The indicator for Whether the provider signs assertions.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SignAssertions')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.SignAssertions')] /../../children [@name='value']/values
SAML2.EncryptAssertions	The indicator for Whether the provider encrypts assertions.The XPath for the attribute name is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.EncryptAssertions')] The XPath for the attribute value is: CommonBaseEvent/extendedDataElements [@name='policyInfo']/children [@name='attributes']/children [@name='attribute']/children [@name='name']/values [contains (.,'SAML2.EncryptAssertions')] /../../children [@name='value']/values

Sample of a IBM_SECURITY_MGMT_POLICY event

The following is an example of a IBM_SECURITY_MGMT_POLICY event:

<CommonBaseEvent 
 creationTime="2006-04-26T12:22:25.874Z" 
 extensionName="IBM_SECURITY_MGMT_POLICY" 
 globalInstanceId="CE11DAD51F526D53D0E30FDAA2C9637F07" 
 sequenceNumber="1" 
 version="1.0.1">
 <extendedDataElements name="action" type="string">
  <values>Create</values>
 </extendedDataElements>
 <extendedDataElements name="outcome" type="noValue">
  <children name="majorStatus" type="int">
   <values>0</values></children>
  <children name="result" type="string">
   <values>SUCCESSFUL</values></children>
 </extendedDataElements>
 <extendedDataElements name="policyInfo" type="noValue">
  <children name="attributes" type="noValue">
   <children name="attribute" type="noValue">
   <children name="value" type="string">
    <values>saml11-ip</values></children>
   <children name="name" type="string">
    <values>FederationName</values></children>
  </children>
  <children name="attribute" type="noValue">
   <children name="value" type="string">
    <values>enabled</values></children>
   <children name="name" type="string">
    <values>State</values></children>
  </children>
  <children name="attribute" type="noValue">
   <children name="value" type="string">
    <values>saml11-ip</values></children>
   <children name="name" type="string">
    <values>FederationId</values></children>
  </children>
  <children name="attribute" type="noValue">
   <children name="value" type="string">
    <values>DefaultKeyStore_testkey</values></children>
   <children name="name" type="string">
    <values>SAML1.SigningKeyIdentifier</values></children>
  </children>
  <children name="attribute" type="noValue">
   <children name="value" type="string">
    <values>true</values></children>
   <children name="name" type="string">
    <values>SAML1.SignArtifactResponse</values></children>
  </children>
  <children name="attribute" type="noValue">
   <children name="value" type="string">
    <values>SAML1_1</values></children>
   <children name="name" type="string">
    <values>FederationProtocol</values></children>
  </children>
 </children>
 <children name="type" type="string">
  <values>federation</values></children>
 <children name="name" type="string">
  <values>saml11-ip</values></children>
 </extendedDataElements>
 <extendedDataElements name="mgmtInfo" type="noValue">
  <children name="command" type="string">
   <values>CreateFederation</values></children>
 </extendedDataElements>
 <extendedDataElements name="userInfo" type="noValue">
  <children name="appUserName" type="string">
   <values>Not Available</values></children>
  <children name="registryUserName" type="string">
   <values>Not Available</values></children>
 </extendedDataElements>
 <sourceComponentId 
  application="IBM Security Verify Access" 
  component="Authentication and Federated Identity" 
  componentIdType="ProductName" 
  executionEnvironment="Linux[x86]#2.4.21-4.EL" 
  location="localhost.localdomain" 
  locationType="FQHostname" 
  subComponent="com.tivoli.am.fim.mgmt.fim.FIMManagementImpl" 
  threadId="SoapConnectorThreadPool : 1" 
  componentType=
  "http://www.ibm.com/namespaces/autonomic/Tivoli_componentTypes"/>
  <situation categoryName="ReportSituation">
   <situationType xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
                  xsi:type="ReportSituation" 
                  reasoningScope="INTERNAL" 
                  reportCatagory="SECURITY"/>
  </situation>
</CommonBaseEvent>

Parent topic: Audit Federation