Tech Tip : CA Single Sign-On :: Policy Server::Access Log Events

Document created by Ujwol Shrestha Employee on Dec 24, 2015Last modified by Ujwol Shrestha Employee on Mar 22, 2017
Version 3Show Document
  • View in full screen mode

TITLE:

What are the various access log events and when are these events logged into the smacess.log (text based audit log) or audit database

DESCRIPTION:

Following are the various access log events which are logged into the audit logs

  • AuthAccept : Occurs if authentication was successful
  • AuthReject  : Occurs if authentication failed for a user
  • AuthAttempt : Occurs if the user is rejected because CA Single Sign-On does not know this user
  • AuthChallenge : Occurs when authenticated user is challenged (for example, custom challenge-response authentication schemes , moving from authentication scheme with low priority to higher priority).
  • AzAccept : Occurs as the result of successful authorization
  • AzReject : Occurs as the result of failed authorization
  • AdminLogin : Occurs as the result of successful administrator login (e.g Administrative UI, FSS UI, XPS Tools etc)
  • AdminLogout : Occurs as the result of administrator logout
  • AdminReject : Occurs as the result of failed administrator login
  • AuthLogout : Occurs when the authentication server logs out a session.
  • ValidateAccept – Occurs as the result of successful validation of the session by the Policy server
  • ValidateReject – Occurs as the result of failed validation of the session by the Policy server (e.g session spec is bad, expired etc

If using audit database, these events are recorded as sm_event_id.

Here is the mapping of various event IDs corresponding to above access log events :

 

1 = AuthAccept
2 = AuthReject
3 = AuthAttempt
4 = AuthChallenge
5 = AzAccept
6 = AzReject
7 = AdminLogin
8 = AdminLogout
9 = AdminReject
10 = AuthLogout
11 = ValidateAccept
12 = ValidateReject
13 = Visit

2 people found this helpful

Attachments

    Outcomes