By: Akhina S Kumar user 18 May 2023 at 7:19 a.m. CDT

8 Responses
Akhina S Kumar gravatar
Hi Team, I was working on a use case to get client authentication failure and success statistics. I can see there are lot of client authentication success messages from /opt/gluu/jetty/oxauth/logs/oxauth.log as beow. 2023-05-11 00:16:03,902 INFO [qtp934275857-155054] [org.gluu.oxauth.auth.Authenticator] (Authenticator.java:278) - Authentication success for Client: '@!DF52.8A2B.1610.1D59!0001!F186.A7D4!0008!0FD1.7A0A' 2023-05-11 00:24:03,900 INFO [qtp934275857-155061] [org.gluu.oxauth.auth.Authenticator] (Authenticator.java:278) - Authentication success for Client: '@!DF52.8A2B.1610.1D59!0001!F186.A7D4!0008!0FD1.7A0A' 2023-05-11 00:34:03,882 INFO [qtp934275857-155078] [org.gluu.oxauth.auth.Authenticator] (Authenticator.java:278) - Authentication success for Client: '@!DF52.8A2B.1610.1D59!0001!F186.A7D4!0008!0FD1.7A0A' 2023-05-11 00:36:03,898 INFO [qtp934275857-155078] [org.gluu.oxauth.auth.Authenticator] (Authenticator.java:278) - Authentication success for Client: '@!DF52.8A2B.1610.1D59!0001!F186.A7D4!0008!0FD1.7A0A' 2023-05-11 00:41:33,905 INFO [qtp934275857-155118] [org.gluu.oxauth.auth.Authenticator] (Authenticator.java:278) - Authentication success for Client: '@!DF52.8A2B.1610.1D59!0001!F186.A7D4!0008!2C56.B8C5' 2023-05-11 00:50:33,943 INFO [qtp934275857-155096] [org.gluu.oxauth.auth.Authenticator] (Authenticator.java:278) - Authentication success for Client: '@!DF52.8A2B.1610.1D59!0001!F186.A7D4!0008!63F6.97CD' But for failure I am not able to trace the details. Is there any option I can trace client authentication failure from Gluu logs. Thanks, Akhina S Kumar

By Aliaksandr Samuseu staff 18 May 2023 at 7:31 a.m. CDT

Aliaksandr Samuseu gravatar
Hi, Akhina. Seems like your logging verbosity level is at defaults? Or have you tried to set "loggingLevel" property to "DEBUG" or "TRACE" for oxAuth on "JSON configuration" page? This should provide you mode details.

By Akhina S Kumar user 18 May 2023 at 7:36 a.m. CDT

Akhina S Kumar gravatar
Hi Aliaksandr, I tried changing the log level and I am getting the below messages from where I can get the client failure details. Client Authentication failed ================================= 2023-05-18 10:58:29,333 TRACE [qtp1686100174-1623413] [org.gluu.service.BaseCacheService] (BaseCacheService.java:84) - Put data, key 'oxId=7009a79e-2102-4498-bb2c-c6c840e7e478,ou=sessions,o=gluu': 'SessionId {dn='oxId=7009a79e-2102-4498-bb2c-c6c840e7e478,ou=sessions,o=gluu', id='7009a79e-2102-4498-bb2c-c6c840e7e478', outsideSid='fa42a8e9-cae6-4ad0-b808-b0ed3cf953c4', lastUsedAt=Thu May 18 10:58:29 UTC 2023, userDn='null', authenticationTime=Thu May 18 10:58:14 UTC 2023, state=unauthenticated, expirationDate=Thu May 18 11:58:14 UTC 2023, sessionState='e46c9b27b11e42c7535ba636da2cd8178e0141a909887d6cae2f102f335b35b7.d7aa7add-99bd-44ee-b92c-470e54c80564', permissionGranted=null, isJwt=false, jwt=null, permissionGrantedMap=SessionIdAccessMap{permissionGranted={dbbc9aa7-90b3-455a-8244-1039b99d4c01=false}}, sessionAttributes={auth_step=1, acr=Azure-O365-Integration, remote_ip=198.151.217.183, auth_external_attributes=null, opbs=c76fef9a-92f7-4670-981f-87d64495fc22, scope=openid user_name profile permission email, response_type=code, redirect_uri=https://#########################/auth/oidc/, state=VyEtsF6zEqEWyAR, nonce=N646604c46c4c4, client_id=dbbc9aa7-90b3-455a-8244-1039b99d4c01, response_mode=form_post}, persisted=true}' 2023-05-18 10:58:29,333 INFO [qtp1686100174-1623413] [org.gluu.oxauth.auth.Authenticator] (Authenticator.java:225) - Authentication failed for 'akhina.kumar@sennovate.com' Client Authentication Success =================================== 2023-05-18 11:02:13,809 TRACE [qtp1686100174-21] [org.gluu.service.BaseCacheService] (BaseCacheService.java:58) - Loaded from cache, key: 'inum=dbbc9aa7-90b3-455a-8244-1039b99d4c01,ou=clients,o=gluu' 2023-05-18 11:02:13,809 DEBUG [qtp1686100174-21] [org.gluu.oxauth.service.ClientService] (ClientService.java:133) - Found 1 entries for client id = dbbc9aa7-90b3-455a-8244-1039b99d4c01 2023-05-18 11:02:13,810 INFO [qtp1686100174-21] [org.gluu.oxauth.auth.Authenticator] (Authenticator.java:278) - Authentication success for Client: 'dbbc9aa7-90b3-455a-8244-1039b99d4c01' 2023-05-18 11:02:13,810 TRACE [qtp1686100174-21] [org.gluu.oxauth.auth.Authenticator] (Authenticator.java:221) - Authentication successfully for 'dbbc9aa7-90b3-455a-8244-1039b99d4c01' 2023-05-18 11:02:13,810 DEBUG [qtp1686100174-21] [gluu.oxauth.token.ws.rs.TokenRestWebServiceImpl] (TokenRestWebServiceImpl.java:124) - Attempting to request access token: grantType = authorization_code, code = 5cbbc1d6-f049-415c-8c0f-95430b950218, redirectUri = ######################3/auth/oidc/, username = null, refreshToken = null, clientId = dbbc9aa7-90b3-455a-8244-1039b99d4c01, ExtraParams = {code=[5cbbc1d6-f049-415c-8c0f-95430b950218], redirect_uri=[######################/auth/oidc/], client_secret=[Qn52pxdxwkcamNdPkldF3aQvxQfhuT4AH2HXjwjg], grant_type=[authorization_code], client_id=[dbbc9aa7-90b3-455a-8244-1039b99d4c01]}, isSecure = true, codeVerifier = null, ticket = null As we are doing it for a continous process the log level chnage will cause lot of memeory issue. Is there any alternate solution for this. Thanks, Akhina S Kumar

By Aliaksandr Samuseu staff 18 May 2023 at 7:48 a.m. CDT

Aliaksandr Samuseu gravatar
Could you try to formulate your requirements more specifically, like which of the log entries you get on TRACE level your actually need, which ones you would like to see, but not getting at the moment even with TRACE level etc - then I'll relay the question to oxAuth dev and may be he'll share some thoughts. Also please elaborate on the possible memory issues you mention, we need to understand that usecase better. By the way, have you also checked oxAuth audit log localed in the same directory? May be it will be of some use too?

By Akhina S Kumar user 18 May 2023 at 11:23 a.m. CDT

Akhina S Kumar gravatar
Hi Aliaksandr, My use case is to get a proper report on the number of client autnetication (successful and failure). For this I have analyzed the oxauth.log and I was able to find the only the client authentication successful entries. There was nothing for client authentication failed. 2023-05-11 00:50:33,943 INFO [qtp934275857-155096] [org.gluu.oxauth.auth.Authenticator] (Authenticator.java:278) - Authentication success for Client: '########################' And also have lot of user authentication failure messages. It doesn't have any information on whether its a normal user or a client associated user. To confirm this I changed the log level to TRACE , which showed me more information about the user authentication failure and I found few entries showing the failure is associated with certain clients. 2023-05-18 10:58:29,333 TRACE [qtp1686100174-1623413] [org.gluu.service.BaseCacheService] (BaseCacheService.java:84) - Put data, key 'oxId=7009a79e-2102-4498-bb2c-c6c840e7e478,ou=sessions,o=gluu': 'SessionId {dn='oxId=7009a79e-2102-4498-bb2c-c6c840e7e478,ou=sessions,o=gluu', id='7009a79e-2102-4498-bb2c-c6c840e7e478', outsideSid='fa42a8e9-cae6-4ad0-b808-b0ed3cf953c4', lastUsedAt=Thu May 18 10:58:29 UTC 2023, userDn='null', authenticationTime=Thu May 18 10:58:14 UTC 2023, state=unauthenticated, expirationDate=Thu May 18 11:58:14 UTC 2023, sessionState='e46c9b27b11e42c7535ba636da2cd8178e0141a909887d6cae2f102f335b35b7.d7aa7add-99bd-44ee-b92c-470e54c80564', permissionGranted=null, isJwt=false, jwt=null, permissionGrantedMap=SessionIdAccessMap{permissionGranted={dbbc9aa7-90b3-455a-8244-1039b99d4c01=false}}, sessionAttributes={auth_step=1, acr=Azure-O365-Integration, remote_ip=198.151.217.183, auth_external_attributes=null, opbs=c76fef9a-92f7-4670-981f-87d64495fc22, scope=openid user_name profile permission email, response_type=code, redirect_uri=################################, state=VyEtsF6zEqEWyAR, nonce=N646604c46c4c4, client_id=####################, response_mode=form_post}, persisted=true}' 2023-05-18 10:58:29,333 INFO [qtp1686100174-1623413] [org.gluu.oxauth.auth.Authenticator] (Authenticator.java:225) - Authentication failed for 'akhina.kumar@sennovate.com' But keeping the log level to TRACE will take more disk space. Also I don't find any entries related to client authentication failure from audit logs. Thanks, Akhina S Kumar

By Akhina S Kumar user 22 May 2023 at 1:14 p.m. CDT

Akhina S Kumar gravatar
Hi Team, Is this information sufficient or you need any further details. Thanks, Akhina S Kumar

By Akhina S Kumar user 25 May 2023 at 2:38 a.m. CDT

Akhina S Kumar gravatar
Hi Team, Any update on this issue. Thanks, Akhina S Kumar

By Aliaksandr Samuseu staff 31 May 2023 at 1:16 p.m. CDT

Aliaksandr Samuseu gravatar
Hi, Akhina. I think your question is clear. The problem is Gluu 4.x is as of recently behind paywall, it's no longer offered free of charge - neither the support for it. Sorry for that. From now on, if you are after the free open-source version of our main product, you should go after [Janssen](https://docs.jans.io/v1.0.13/). That's the main focus of development right now, and Gluu CE is considered a legacy software now. @Mobarak Hosen.Shakil , could you please investigate quickly whether or not Janssen can offer customizable logging features like Akhina was talking about, and share the results in the ticket?

By Aliaksandr Samuseu staff 31 May 2023 at 2:23 p.m. CDT

Aliaksandr Samuseu gravatar
Hi, Akhina. Sorry about all the chaos - we're in the middle of transition over here.. I stay corrected - as of now this Support Board is only for paying customer's access. No community tickets will be served here. As Janssen is the new free of charge offer, all discussions related to it must go to its own [discussion boards](https://github.com/JanssenProject/jans/discussions). I'll be closing this ticket now.