authentication category
This category of logs contains all the business requests concerning JWT authentication tokens. These are generated by a third-party tool and guarantee the user's identity.
Verify action
The verify action means that a JWT authentication token has just been validated. It generates an "info" severity log if the token is valid, or a "notice" severity log if it is invalid.
The log fields for this action are as follows:
Field |
Description |
Type |
Mandatory/Optional |
---|---|---|---|
tenant_id |
Tenant identifier. Example: 025f02fe-bee2-444b-bf76-b5ead30327c0 |
String in uuid v4 format | Mandatory |
jwk |
Information concerning the JWK used to validate the token. |
Object | Mandatory |
jwt |
Token content. |
Object | Mandatory |
valid |
Checking token legitimacy. Prescribed values:
|
Boolean | Mandatory |
source |
JWK configuration source. Prescribed values:
|
String | Mandatory |
type |
Token type. Prescribed values:
|
String | Mandatory |
details |
Additional message describing the cause of the token refusal. Present only when the token is invalid: Example: JWT expired |
String | Optional |
JWK object description
Field |
Description |
Type |
Mandatory/Optional |
---|---|---|---|
kid |
Key identifier. Example: 87bbe0815b064e6d449cac999f0e50e72a3e4374 |
String | Mandatory |
alg |
Algorithm used. Prescribed value:
|
String | Mandatory/ |
JWT object description
Field |
Description |
Type |
Mandatory/Optional |
---|---|---|---|
|
Email address of the user concerned by the token. Example: alice.dupont@gmail.com |
String | Mandatory |
google_email |
User's Google account email address. This field is always absent in the case of a digest action. Example: alice.google@gmail.com |
String |
Optional |
iss |
Service that generates the token (issuer). Example: https://google.onelogin.com/ |
String | Mandatory |
aud |
Token recipient (audience). Example: a7cb5600-cbb0-023b-531e-02449949762c38534 |
String array | Mandatory |
exp |
Expiry time after which the JWT must no longer be accepted. In the form of a timestamp in seconds. Example: 1720542398 |
Integer | Mandatory |
iat |
Token creation date (issued at). In the form of a timestamp in seconds. Example: 1720535198 |
Integer | Mandatory |
number_of_custom_claims |
Number of custom claims contained in the token. Example: 1 |
Integer | Mandatory |
kacls_url |
KACLS URL, for kacls_to_kacls tokens only. Example: https://cse.mysds.io/api/v1/f438ae27-f33d-1fa3-b1e2-efc4d7635684 |
String | Optional |
resource_name |
Token resource identifier, for kacls_to_kacls tokens only. Example: //googleapis.com/drive/files/1OJsaKJM5JES1yi79QCKx-13wOR1i8JPU |
String | Optional |