authentication category

This category of logs contains all the business requests concerning JWT authentication tokens. These are generated by a third-party tool and guarantee the user's identity.

Verify action

The verify action means that a JWT authentication token or an API key has been validated. It generates an "info" severity log if the token is valid, or a "notice" severity log if it is invalid.

The log fields for this action are as follows:

Field

Description

 Type

Mandatory/Optional

tenant_id

Tenant identifier.

Example: 025f02fe-bee2-444b-bf76-b5ead30327c0

 String in uuid v4 format Mandatory
method

Method used for authentication.

Prescribed values:

  • jwt

  • api_key

 String Mandatory

jwk

Information concerning the JWK used to validate the token.

See JWK object description.

 Object Mandatory if method is set to jwt

jwt

Token content.

See JWT object description.

 Object Mandatory if method is set to jwt

valid

Checking JWT token or API key legitimacy.

Prescribed values:

  • true

  • false

Boolean Mandatory

source

JWK configuration source.

Prescribed values:

  • local_configuration

  • remote_well_known_cse_configuration

Only local_configuration if method is set to api_key.

 String Mandatory

type

Token type if method is set to jwt.

Prescribed values:

  • user_authentication

  • admin_authentication

  • kacsl-to-kacls_authentication

  • wrapprivatekey_authentication

  • delegate_authentication

  • crypto_api_authentication

Authenticated module if method is set to api_key.

Prescribed values:

  • crypto_api_authentication

  • pki_authentication

String Mandatory

details

Additional message describing the cause of the token refusal. Present only when the token is invalid:

Example: JWT expired

 String Optional

JWK object description

Field

Description

 Type

Mandatory/Optional

kid

Key identifier.

Example: 87bbe0815b064e6d449cac999f0e50e72a3e4374

 String Mandatory

alg

Algorithm used.

Prescribed value:

  • RS256

String Mandatory/

JWT object description

Field

Description

 Type

Mandatory/Optional

email

Email address of the user concerned by the token.

Example: alice.dupont@gmail.com

 String Mandatory

google_email

User's Google account email address. This field is always absent in the case of a digest action.

Example: alice.google@gmail.com

 String
Optional

iss

Service that generates the token (issuer).

Example: https://google.onelogin.com/

 String Mandatory

aud

Token recipient (audience).

Example: a7cb5600-cbb0-023b-531e-02449949762c38534

 String array Mandatory

exp

Expiry time after which the JWT must no longer be accepted. In the form of a timestamp in seconds.

Example: 1720542398

 Integer Mandatory

iat

Token creation date (issued at). In the form of a timestamp in seconds.

Example: 1720535198

 Integer Mandatory

number_of_custom_claims

Number of custom claims contained in the token.

Example: 1

 Integer Mandatory

kacls_url

KACLS URL, for kacls_to_kacls tokens only.

Example: https://cse.mysds.io/api/v1/f438ae27-f33d-1fa3-b1e2-efc4d7635684

 String Optional

resource_name

Token resource identifier, for kacls_to_kacls tokens only.

Example: //googleapis.com/drive/files/1OJsaKJM5JES1yi79QCKx-13wOR1i8JPU

 String Optional

delegated_to

 Identifier of the entity to which authentication is delegated. Example: "Authentication delegated to Alice Dupont" String Optional
kacls_owner_domain Optional claim configured by the Google Workspace's owner to change the domain used in the request to the KACLS. It prevents from registering unauthorized KACLS. String Optional