authorization category

This log category contains all business requests concerning JWT authorization tokens that enable checks to be run to see whether the user is authorized or not.

Verify action

The verify action means that an authorization token has just been validated. It generates an "info" severity log if the token is valid, or a "notice" severity log if it is invalid.

The log fields for this action are as follows:

Field

Description

 Type

Mandatory/Optional

tenant_id

Tenant identifier.

Example: 025f02fe-bee2-444b-bf76-b5ead30327c0

 String in uuid v4 format Mandatory

jwk

Information concerning the JWK used to validate the token.

See JWKS object description.

 Object Mandatory

jwt

Token content.

See JWT object description.

 Object Mandatory

valid

Checking token legitimacy.

Prescribed values:

  • true

  • false

Boolean Mandatory

type

Token type.

Prescribed values:

  • standard_authorization

  • gmail_smime_authorization

  • migration_authorization

  • delegate_authorization

 String Mandatory

details

Additional message describing the cause of the token refusal. Present only when the token is invalid:

Example: JWT expired

 String Optional

JWKS object description

Field

Description

 Type

Mandatory/Optional

kid

Key identifier.

Example: 87bbe0815b064e6d449cac999f0e50e72a3e4374

 String Mandatory

alg

Algorithm used.

Prescribed value:

  • RS256

String Mandatory

JWT object description

Field

Description

 Type

Mandatory/Optional

email

Email address of the user concerned by the token.

Example: alice.dupont@gmail.com

 String Mandatory

iss

Service that generates the token (issuer).

Example: https://google.onelogin.com/

 String Mandatory

aud

Token recipient (audience).

Example: a7cb5600-cbb0-023b-531e-02449949762c38534

 String array Mandatory

exp

Expiry time after which the JWT must no longer be accepted. In the form of a timestamp in seconds.

Example: 1720542398

 Integer Mandatory

role

Role of the user.

Example: reader

 String Mandatory

iat

Token creation date (issued at). In the form of a timestamp in seconds.

Example: 1720535198

 Integer Optional

resource_name

Token resource identifier, for kacls_to_kacls tokens only.

Example: //googleapis.com/drive/files/1OJsaKJM5JES1yi79QCKx-13wOR1i8JPU

 String Optional

perimeter_id

Identifier to perform a check on authorization requests.

Example: 22041999

 String Optional

kacls_url

KACLS URL, for kacls_to_kacls tokens only.

Example: https://cse.mysds.io/api/v1/f438ae27-f33d-1fa3-b1e2-efc4d7635684

 String Optional

email_type

Origin of the user's email address.

Example: "google"

 String Optional

message_id

Identifier of the message on which the signature or decryption operation has been performed.

Example: <CADBpGcUzg2iGuYyRoGkQg4F8sHXNoQtxbSxS7OiyJg
@mail.gmail.com>

 String Optional

spki_hash_algorithm

Algorithm used to produce the spki_hash.

Example: SHA-256

 String Optional

spki_hash

base64 digest of the public key.

Example: YSBzcGtpIGhhc2ggb2YgdGhlIHB1YmxpYyBrZXk=

 String Optional

number_of_custom_claims

Number of custom claims contained in the token.

Example: 1

 Integer Mandatory