SSO audit logging - Mint Starter Kit

Overview

SSO audit logging provides comprehensive tracking of all authentication-related events, configuration changes, and user activity. This enables security monitoring, compliance reporting, troubleshooting, and forensic analysis.

Accessing audit logs

Navigate to the audit logs page in your admin dashboard:

https://your-domain.com/admin/audit-logs

Event types

Authentication events

Event Type	Description	Severity
`auth.login.success`	Successful SSO login	Info
`auth.login.failed`	Failed login attempt	Warning
`auth.logout`	User logout (including RP-initiated)	Info
`auth.token.issued`	Access token issued	Info
`auth.token.refreshed`	Access token refreshed	Info
`auth.token.revoked`	Access token revoked	Warning
`auth.session.expired`	User session expired	Info

Provider configuration events

Event Type	Description	Severity
`provider.created`	New SSO provider added	Info
`provider.updated`	Provider configuration changed	Info
`provider.deleted`	Provider removed	Warning
`provider.enabled`	Provider enabled	Info
`provider.disabled`	Provider disabled	Warning
`provider.test`	Provider test login performed	Info

User account events

Event Type	Description	Severity
`user.created`	New user account created via JIT provisioning	Info
`user.updated`	User profile updated	Info
`user.suspended`	User account suspended	Warning
`user.reactivated`	Suspended user reactivated	Info
`user.deleted`	User account deleted	Warning
`user.roles.synced`	User roles synchronized from IdP	Info
`user.roles.updated`	User roles manually updated	Info

Connected account events

Event Type	Description	Severity
`account.connected`	SSO account connected to user	Info
`account.disconnected`	SSO account disconnected	Warning
`account.linked`	Multiple SSO accounts linked	Info
`account.unlinked`	SSO accounts unlinked	Warning

Log entry details

Each audit log entry contains:

Core fields

Field	Description
Timestamp	When the event occurred (UTC)
Event type	Type of event (see event types above)
Severity	Info, Warning, Error, or Critical
User	User who triggered the event (if applicable)
IP address	Source IP address
User agent	Browser/client information

Event-specific data

Field	Description
Provider	SSO provider involved
Action	Specific action performed
Resource	Resource affected (user, provider, etc.)
Changes	What changed (for update events)
Error message	Error details (for failed events)
Session ID	Session identifier
Request ID	Unique request identifier for correlation

Example log entries

{
  "timestamp": "2024-01-15T10:30:45.123Z",
  "eventType": "auth.login.success",
  "severity": "info",
  "user": {
    "id": "user_123",
    "email": "[email protected]"
  },
  "provider": "google",
  "ipAddress": "203.0.113.42",
  "userAgent": "Mozilla/5.0...",
  "sessionId": "sess_abc123",
  "requestId": "req_xyz789"
}

{
  "timestamp": "2024-01-15T10:32:15.456Z",
  "eventType": "auth.login.failed",
  "severity": "warning",
  "provider": "okta",
  "ipAddress": "203.0.113.42",
  "userAgent": "Mozilla/5.0...",
  "error": "Invalid credentials",
  "requestId": "req_abc456"
}

Provider configuration change

{
  "timestamp": "2024-01-15T09:15:30.789Z",
  "eventType": "provider.updated",
  "severity": "info",
  "user": {
    "id": "admin_456",
    "email": "[email protected]"
  },
  "provider": "azure",
  "changes": {
    "scopes": {
      "old": "openid profile email",
      "new": "openid profile email groups"
    }
  },
  "ipAddress": "203.0.113.10",
  "requestId": "req_def789"
}

Filtering and search

Search capabilities

Search audit logs using various criteria:

Text search: Search across all text fields
User: Filter by specific user
Provider: Filter by SSO provider
Event type: Filter by event type
Severity: Filter by severity level
Date range: Filter by time period
IP address: Filter by source IP

Advanced filters

Combine multiple filters for precise queries:

Event type: auth.login.failed
Provider: okta
Date range: Last 7 days
IP address: 203.0.113.*

Saved searches

Save frequently used search queries:

Create search

Configure your search filters

Click save search

Click “Save Search” button

Name the search

Enter a descriptive name (e.g., “Failed Okta logins”)

Access saved searches

Access from the “Saved Searches” dropdown

Monitoring and alerts

Real-time monitoring

Monitor authentication events in real-time:

Live event stream
Auto-refresh every 30 seconds
Desktop notifications for critical events
Sound alerts for security events

Alert configuration

Set up alerts for specific events:

Navigate to alerts

Go to Admin → Audit Logs → Alerts

Create alert

Click “Create Alert”

Configure conditions

Set alert conditions:

Event type
Severity level
Frequency threshold
Time window

Configure notifications

Choose notification methods:

Email
Slack
Webhook
SMS (if configured)

Save alert

Save and enable the alert

Example alerts

Alert: Failed login threshold
Condition: 5 or more failed logins from same IP in 10 minutes
Notification: Email to security team

Provider configuration changes

Alert: Provider modified
Condition: Any provider.updated or provider.deleted event
Notification: Slack channel #security-alerts

Suspicious activity

Alert: Unusual login location
Condition: Login from new country/region
Notification: Email to user and security team

Compliance and reporting

Compliance reports

Generate reports for compliance requirements:

SOC 2 authentication report

All authentication events
Failed login attempts
Account changes
Provider configuration changes

All events for a specific user
Account creation and deletion
Data access events
Consent changes

HIPAA access audit

User authentication events
Role changes
Access to sensitive resources
Failed access attempts

Generating reports

Navigate to reports

Go to Admin → Audit Logs → Reports

Select report type

Choose a compliance report template or create custom

Configure parameters

Set date range, users, providers, etc.

Generate report

Click “Generate Report”

Export report

Download as PDF, CSV, or JSON

Log retention

Retention policies

Configure how long audit logs are retained:

Tier	Retention Period	Storage
Standard	90 days	Database
Extended	1 year	Database + Archive
Compliance	7 years	Archive storage

Archiving

Older logs are automatically archived:

Compressed and stored in archive storage
Searchable through archive interface
Can be restored for investigation
Compliant with data retention regulations

Export for long-term storage

Export logs for external archiving:

Navigate to export

Go to Admin → Audit Logs → Export

Select date range

Choose the time period to export

Choose format

Select JSON, CSV, or JSONL format

Download archive

Download the compressed archive file

Security monitoring use cases

Detecting brute force attacks

Monitor for multiple failed login attempts:

Filter: auth.login.failed
Group by: IP address
Threshold: 10+ attempts in 5 minutes

Identifying compromised accounts

Look for unusual login patterns:

Logins from new locations
Logins at unusual times
Multiple concurrent sessions
Rapid provider switching

Tracking privilege escalation

Monitor role changes:

Filter: user.roles.updated
Alert: When admin role is assigned
Review: Manual role changes

Detecting configuration tampering

Track provider configuration changes:

Filter: provider.updated OR provider.deleted
Alert: Any configuration change
Review: Who made the change and what changed

Troubleshooting with audit logs

Debugging authentication failures

Search for user

Filter logs by user email or ID

Find failed events

Look for auth.login.failed events

Review error messages

Check the error field for specific failure reasons

Check provider logs

Review provider-specific events around the same time

Verify configuration

Ensure provider configuration hasn’t changed

Investigating role issues

Search for user

Filter logs by user email or ID

Find role events

Look for user.roles.synced and user.roles.updated events

Review changes

Check what roles were added or removed

Check group mappings

Verify group-to-role mapping configuration

Review IdP groups

Check what groups the IdP is sending

API access to audit logs

REST API

Access audit logs programmatically:

GET /api/v1/audit-logs
Authorization: Bearer <token>

Query parameters:
- startDate: ISO 8601 timestamp
- endDate: ISO 8601 timestamp
- eventType: Event type filter
- userId: User ID filter
- provider: Provider ID filter
- limit: Results per page (max 100)
- offset: Pagination offset

Webhook integration

Stream audit events to external systems:

Configure webhook

Go to Admin → Audit Logs → Webhooks

Add endpoint

Enter your webhook URL

Select events

Choose which event types to send

Configure authentication

Set up webhook authentication (HMAC signature)

Test webhook

Send a test event to verify configuration

SIEM integration

Integrate with Security Information and Event Management systems:

Splunk
Datadog
Elastic Stack
Azure Sentinel
AWS CloudWatch

Best practices

Regular review

Review audit logs regularly (daily or weekly) to identify patterns and anomalies.

Set up alerts

Configure alerts for critical security events to enable rapid response.

Retain logs appropriately

Follow your organization’s retention policies and compliance requirements.

Protect log access

Restrict audit log access to authorized administrators only.

Export regularly

Export logs to external storage for long-term retention and disaster recovery.

Correlate events

Use request IDs to correlate related events across the authentication flow.

Next steps

User management

Manage users and investigate account issues

Admin UI

Configure SSO providers and settings

Role mapping

Configure automatic role assignment

OIDC setup

Set up OIDC authentication providers

Getting started

App features

Development

Authentication

Third party providers

Knowledge Base

​Overview

​Accessing audit logs

​Event types

​Authentication events

​Provider configuration events

​User account events

​Connected account events

​Log entry details

​Core fields

​Event-specific data

​Example log entries

​Successful login

​Failed login attempt

​Provider configuration change

​Filtering and search

​Search capabilities

​Advanced filters

​Saved searches

​Monitoring and alerts

​Real-time monitoring

​Alert configuration

​Example alerts

​Multiple failed login attempts

​Provider configuration changes

​Suspicious activity

​Compliance and reporting

​Compliance reports

​SOC 2 authentication report

​GDPR user activity report

​HIPAA access audit

​Generating reports

​Log retention

​Retention policies

​Archiving

​Export for long-term storage

​Security monitoring use cases

​Detecting brute force attacks

​Identifying compromised accounts

​Tracking privilege escalation

​Detecting configuration tampering

​Troubleshooting with audit logs

​Debugging authentication failures

​Investigating role issues

​API access to audit logs

​REST API

​Webhook integration

​SIEM integration

​Best practices

​Next steps