-
Notifications
You must be signed in to change notification settings - Fork 18
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Configure Keycloak audit log #522
Configure Keycloak audit log #522
Comments
Just adding a note here @austenbryan would love metrics showing 'active users over time'. I believe this would be necessary to provide that kind of view. I also noticed https://github.com/aerogear/keycloak-metrics-spi which would might be worth looking into but would probably be less useful for auditing and satisfying controls. |
Poked at this for a second and realized we are already logging events, but they were not JSON so created this PR #610 to enable JSON logging. Unfortunately the default event handler prints the event information as part of its string "message" so if we actually wanted to leverage this for auditing I think we'd probably want to create a custom event listener that printed the event information as JSON. There might be existing implementations out there. |
## Description Adds optional flag to configure Keycloak to log JSON formatted logs. Defaults to `true`. JSON formatted log lines are preferable when doing log aggregation or parsing and allows users to filter more sanely when viewing logs in Grafana. This would also be a step in the direction of satisfying auditing and reporting needs based on existing log output as mentioned in #522. Note: This falls short of addressing our auditing/reporting needs for Keycloak as event log information is surfaced in the the log line as a `message` field which ends up being a string regardless of this PR. ## Related Issue Relates to #522 ## Type of change - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Other (security config, docs update, etc) ## Checklist before merging - [ ] Test, docs, adr added or updated as needed - [ ] [Contributor Guide](https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md) followed Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>
We intend to satisfy AC 2.1 with auditing/events from Keycloak but these events are currently not configured to ship anywhere.
The easiest thing to do would probably be audit and ensure:
See: https://www.keycloak.org/docs/latest/server_admin/#configuring-auditing-to-track-events
The text was updated successfully, but these errors were encountered: