Security Logging¶
In addition to other logging options, Atfinity logs security relevant actions in a special way to make it easy to detect suspicious activity. Security logging happens via the default logging mechanism.
Logging Format¶
A typical entry in the log for a security relevant user actions looks like this:
2021-03-16 14:34:31,581 [USER_ACTION] [0b4f2d1c-1f7a-4a3c-9d61-8c2e4f5a6b70] - ACTION update_phone_number USER thorben@atfinity.ch IP 165.5.3.18 PARAMS <QueryDict: {}> DATA {'phone_number': '+41786167706', 'tenant': 1} PATH /api/1/admin/users/26
As you can see, the date and time (2021-03-16 14:34:31,581), the request id
(0b4f2d1c-1f7a-4a3c-9d61-8c2e4f5a6b70), the action (update_phone_number), the performing user
(thorben@atfinity.ch), the client IP (165.5.3.18) the query params (if any) the data of the change (so here the new
phone number) and the local path are logged.
With this information, it's possible to trace back exactly which action happened and what data has been
manipulated.
Info
If the request contains sensitive information like a password, this information is displayed with stars, e.g.
********
Following a Request¶
Info
New in Atfinity 17.
Every log line of a request carries its request id, in square brackets after the log level, so all the lines of one
request can be read together.
The last line of a request names its method, path and status and says how long the request took, for example
POST /api/1/cases 200 in 312.4 ms.
Health probes are answered without that line, so a monitoring system polling them does not fill the log.
Work a request hands off to run in the background keeps the same id, so a request that starts an export, a document
or an integration call can be followed into the work it caused, however much later that runs.
Background work that no request started, for example a scheduled rule, gets an id of its own for that run.
Lines that belong to no request and no background work show - instead.
Atfinity generates a request id per request and returns it in the X-Request-ID response header.
To follow a request from your own gateway into Atfinity, send your own id in an X-Request-ID request header and
Atfinity uses it instead:
curl -H "X-Request-ID: your-own-id" -H "Authorization: Api-Key $ATFINITY_API_KEY" \
https://your-tenant.atfinity.app/api/1/cases/
An id you send is accepted when it is at most 200 characters long and uses only letters, digits and the characters
., _, :, @, =, +, / and -.
Anything else is replaced by a generated id, which is still returned in the response header.
Logged Actions¶
A refused login is recorded under the tenant of the user it names.
When no user has the given email address, it is recorded under the tenant the login page was opened on.
login_success, error_login_unknown_username, error_login_inactive_account, error_login_of_locked_user,
error_login_of_user_no_longer_valid and error_login_without_permissions are recorded for SAML and OpenID Connect
logins as well.
Changes that Entra ID makes through SCIM are recorded with SCIM as the user,
and name the user they changed in the data.
At least these security relevant actions are logged:
| Key | Description | Since version |
|---|---|---|
| Login | ||
login_password_change_required |
The user that made a login requests needs a password change. | |
login_success |
Successful login. | |
login_with_password_change |
Successful login after the user changed the password. | |
| Login Errors | ||
error_login_without_sso_but_sso_required |
The user that made the login request tried to log in with a password, but is only cleared for login via SSO. | |
error_login_of_locked_user |
The user that made the login request is locked. | |
error_login_invalid_2fa_code |
The user provided an invalid 2FA code. | |
error_login_inactive_account |
The given username exists, but the user is marked as inactive. | |
error_login_wrong_password |
The given password doesn't match the given username. | |
error_login_unknown_username |
The given username is unknown. | |
error_login_without_permissions |
The user has neither a role nor admin access. | 17 |
error_login_saml_user_without_tenant |
The user that logged in with SAML belongs to no tenant. | 17 |
error_login_saml_without_groups |
The SAML response carries no groups. | 17 |
error_login_saml_without_application_access_group |
The SAML groups do not contain the application access group, or the tenant has none configured. | 17 |
error_login_saml_without_roles |
No SAML group matches a role, and none grants admin access. | 17 |
error_login_saml_unreadable_attributes |
The attributes of the SAML response could not be read. | 17 |
error_login_saml_response_rejected |
The SAML response was rejected before the user was identified, for example for an invalid signature or because the identity provider denied the login. | 17 |
error_login_oidc_user_without_tenant |
The user that logged in with OpenID Connect belongs to no tenant. | 18 |
error_login_oidc_without_groups |
The identity provider sent no groups over OpenID Connect. | 18 |
error_login_oidc_without_application_access_group |
The OpenID Connect groups do not contain the application access group, or the tenant has none configured. | 18 |
error_login_oidc_without_roles |
No OpenID Connect group matches a role, and none grants admin access. | 18 |
error_login_oidc_unreadable_claims |
The groups claim of the OpenID Connect sign-in could not be read, for example because the identity provider reports the group list as truncated. | 18 |
error_login_oidc_response_rejected |
The OpenID Connect sign-in was rejected before the user was identified, for example because the identity provider returned an error, the answer did not match a sign-in this browser started, or it carried no email address. The reason is recorded with the action. | 18 |
error_login_oidc_bound_to_another_identity |
The OpenID Connect sign-in carried the email address of a user linked to another account of the identity provider. The issuer, the client ID, both sub values, when the link was made and, from Entra ID, the oid are recorded with the action, so the identity provider's administrator can compare the two accounts. When a simultaneous sign-in linked the sub to another user a moment earlier, only the issuer, the client ID and the presented sub are recorded. |
18 |
login_oidc_identity_bound |
A user was linked to their identity provider account on their first OpenID Connect sign-in under this issuer and client ID. The issuer, the client ID and the sub are recorded with the action. |
18 |
login_oidc_with_another_email_address |
A linked user signed in while the identity provider sent another email address than the one in Atfinity. That address is recorded with the action, along with whether it belongs to another user. | 18 |
single_sign_on_identity_forgotten |
An operator removed the link between a user and their identity provider account, so their next sign-in links them by email address again. It is recorded once per link, under the user system, with the user's email address, the issuer, the client ID and the sub. |
18 |
error_login_of_user_no_longer_valid |
The user that made the login request is past the date the account is valid until. | |
error_login_2fa_timeout |
A 2FA code was entered after it expired, or without one having been requested. | 17 |
error_login_2fa_not_set_up |
The user has to log in with 2FA but has no 2FA method set up. | 17 |
error_login_password_change_refused |
The user had to change the password and the new password was refused. | 17 |
| Case Manager | ||
download_booklet |
The booklet of a case was downloaded as a PDF file. | |
download_booklet_zip |
The booklet of a case was downloaded as a zip file. | |
send_booklet |
The booklet of a case was send via email. | |
download_uploaded_documents |
All the uploaded files of a case were downloaded as a zip file. | |
unautorized_case_request |
The user doesn't have access to the requested case | |
| Integrations | ||
get_comply_advantage_hits_for_person |
A request was sent to ComplyAdvantage. | |
get_world_check_hits_for_person |
A request was sent to WorldCheck. | |
send_custom_api_request |
Custom API request was sent. | |
create_idnow_ident |
A request to IDNow was sent. | |
send_sms |
SMS was sent. | |
send_email |
Email was sent. | |
external_source_search |
A search request to external data source was sent. | |
external_source_load_values |
A request to load values from external data source was sent. | |
| Avaloq | ||
avaloq_export_create |
Avaloq xml file was created for a case. | |
avaloq_export_toogle_email_updates |
The user has toogled the subscription to email updates about Avaloq response for a specific case. | |
avaloq_export_download_xml |
Avaloq xml file of a case was downloaded. | |
avaloq_export_download_result_xml |
Avaloq result xml file of a case was downloaded. | |
| HyperArchive | ||
hyperarchive_export_create |
Case documents and sidecar files were exported to HyperArchive folder. | |
hyperarchive_download_rendered_files |
HyperArchive sidecar files of a case were downloaded. | |
| Admin | ||
create_user |
User was created. | |
create_users_via_import |
Users were created while importing a user list | 10.3 |
update_user_roles |
Roles of a user were changed. | |
update_user_groups |
Groups of a user were changed. | |
reset_password |
Password of a user was reset. | |
reset_users_password_via_import |
Some user passwords were reset while importing a user list | 10.3 |
update_user_details |
Details about a user were updated. | |
delete user |
A user was deleted | 10.3 |
delete_users_via_import |
Users were deleted while importing a user list | 10.3 |
switch_tenant |
The user has switched to a different tenant. | |
create_scim_token |
A SCIM token was generated for the tenant. | 18 |
revoke_scim_token |
The SCIM token of the tenant was revoked. | 18 |
| SCIM | ||
scim_create_user |
Entra ID created a user. | 18 |
scim_link_user |
Entra ID took over a user who already existed with the same email address. | 18 |
scim_update_user |
Entra ID changed the email address, the name or the external ID of a user, or reactivated them. | 18 |
scim_deactivate_user |
Entra ID deactivated a user. | 18 |
scim_delete_user |
Entra ID deleted a user. | 18 |