Categories of Audit Events

7-16 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation – ProtocolVersion ■ LocalAuthentication – Authentication of a user at OIF – AuthenticationMechanism – AuthenticationEngineID – RemoteIP – SessionID – UserID ■ LocalLogout - Logout of a user at Oracle Identity Federation – RemoteIP – SessionID – UserID 7.4.1.1.2 Protocol Flow Events Protocol flow events and their attributes are as follows: ■ IncomingMessage – Message being received by Oracle Identity Federation – RemoteIP – Binding for example, SOAPGETPOSTArtifact… – ProtocolVersion for example, SAML2Libv11… – RemoteProviderID – Role for example, Service ProviderIdentity ProviderAttribute Authority… – IncomingMessageString CLOB – MessageType for example, SSOLoginRequestSSOLoginResponseSSOLogoutRequest… ■ OutgoingMessage - Message being sent by Oracle Identity Federation Success only – RemoteIP – Binding for example, SOAPGETPOSTArtifact… – ProtocolVersion for example, SAML2Libv11… – RemoteProviderID – Role for example, Service ProviderIdentity ProviderAttribute Authority… – OutgoingMessageString CLOB – MessageType for example, SSOLoginRequestSSOLoginResponseSSOLogoutRequest… ■ AssertionCreation – Creation of an assertion by Oracle Identity Federation Success only – RemoteIP – ProtocolVersion for example, SAML2Libv11… – AssertionVersion for example, 2.0 Diagnostics and Auditing 7-17 – IssueInstant – Issuer – NameIDQualifier – NameIDValue – NameIDFormat – AssertionID – UserID – SessionID – FederationID – RemoteProviderID ■ AssertionConsumption - Consumption of an assertion by Oracle Identity Federation Success only – ProtocolVersion for example, SAML2Libv11… – AssertionVersion for example, 2.0 – IssueInstant – Issuer – NameIDQualifier – NameIDValue – NameIDFormat – AssertionID – UserID – SessionID – FederationID – RemoteProviderID

7.4.1.1.3 Server Configuration Events

Server configuration events and their attributes are as follows: ■ CreateConfigProperty – Adding a new configuration propertySuccess only – PropertyName – PropertyType for example, PropertiesList, PropertiesMap, String, Boolean… – Value – PeerProviderID – Hierarchy ■ ChangeConfigProperty - Changing the value of an existing configuration propertySuccess only – PropertyName – PropertyType for example, PropertiesList, PropertiesMap, String, Boolean… – OldValue 7-18 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation – NewValue – PeerProviderID – Hierarchy ■ DeleteConfigProperty - Deleting a configuration property Success only – PropertyName – PropertyType for example, PropertiesList, PropertiesMap, String, Boolean… – OldValue – PeerProviderID – Hierarchy ■ CreatePeerProvider – Adding a new provider to the list of trusted providers Success only – PeerProviderID – ProviderType for example, sp, idp, sp idp,… – ProtocolVersion – Description ■ UpdatePeerProvider - Updating the information on an existing provider in the list of trusted providers Success only ■ PeerProviderID – PeerProviderID – ProviderType for example, sp, idp, sp idp,… – ProtocolVersion – Description ■ DeletePeerProvider - Deleting a provider from the list of trusted providers Success only – PeerProviderID – ProviderType for example, sp, idp, sp idp,… – ProtocolVersion – Description ■ LoadMetadata – Loading of metadata Success only – Metadata – Description ■ SetDataStoreType – Changing the type of a data store Success only – DataStoreName – OldValue – NewDataStoreType ■ ChangeDataStore – Setting of the federation data store Success only – DataStoreBefore – DataStoreAfter Diagnostics and Auditing 7-19 ■ ChangeFederation – Changing of the trusted providers Success only – COTBefore – COTAfter ■ ChangeServerProperty – Changing of a server configuration property Success only – ServerConfigBefore – ServerConfigAfter

7.4.1.1.4 Security Events

Security events and their attributes are as follows: ■ CreateSignature – Creation of a digital signature by Oracle Identity Federation – Type XML, String ■ VerifySignature – Verification of a digital signature by Oracle Identity Federation – Type XML, String ■ EncryptData – Encryption of data by Oracle Identity Federation – Type XML, String ■ DecryptData – Decryption of data by Oracle Identity Federation – Type XML, String

7.4.1.1.5 Attributes Shared by All Events In addition there are attributes shared for all

events: ■ timestamp - the timestamp of when the audit event occurred ■ initiator - the initiator of the audit event for some events this attribute may be empty ■ ECID - the execution context ID

7.4.1.2 Audit Levels

Fusion Middleware Audit Framework supports the following audit levels: ■ None ■ Low ■ Medium ■ Custom The following audit events get audited at the Low and Medium audit levels: Events Audited at Low level ■ ServerConfiguration – CreateConfigProperty – ChangeConfigProperty Note: FAILURESONLY denotes that the event will only get audited in case of failure. 7-20 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation – DeleteConfigProperty – CreatePeerProvider – UpdatePeerProvider – DeletePeerProvider – LoadMetadata – SetDataStoreType – ChangeDataStore – ChangeCOT – ChangeServerProperty Events Audited at Medium level ■ ServerConfiguration – CreateConfigProperty – ChangeConfigProperty – DeleteConfigProperty – CreatePeerProvider – UpdatePeerProvider – DeletePeerProvider – LoadMetadata – SetDataStoreType – ChangeDataStore – ChangeCOT – ChangeServerProperty ■ UserSession.FAILUREONLY – CreateUserSession.FAILUREONLY – DeleteUserSession.FAILUREONLY – CreateUserFederation.FAILUREONLY – UpdateUserFederation.FAILUREONLY – DeleteUserFederation.FAILUREONLY – CreateActiveUserFederation.FAILUREONLY – DeleteActiveUserFederation.FAILUREONLY – LocalAuthentication.FAILUREONLY – LocalLogout.FAILUREONLY ■ ProtocolFlow.FAILUREONLY – IncomingMessage.FAILUREONLY – OutgoingMessage.FAILUREONLY – AssertionCreation.FAILUREONLY – AssertionConsumption.FAILUREONLY Diagnostics and Auditing 7-21 ■ Security.FAILUREONLY – CreateSignature.FAILUREONLY – VerifySignature.FAILUREONLY – EncryptData.FAILUREONLY – DecryptData.FAILUREONLY Events Audited at Custom Level The Custom audit level allows you to select only the events you wish to audit.

7.4.2 Configuring Auditing for Oracle Identity Federation

You can use Oracle Enterprise Manager Fusion Middleware Control or WLST command-line interface to configure auditing. Take these steps to get started with configuring auditing with Fusion Middleware Control:

1. Log in to Fusion Middleware Control and navigate to the Identity Management

domain.

2. In the Weblogic Domain drop down menu, select Security, then Audit Policy.

3. Select the Oracle Identity Federation component.

4. In the Audit Level menu, select the desired audit level.

You can view the audit policies that will be enforced in different categories by expanding the + check-box for the component. 5. Optionally, in the Users text box, you can add users who will always be audited for all events, regardless of audit level.

6. Click Apply.

7.4.2.1 Configuring Auditing at the Custom Level

Take these steps if you are configuring audit policies and wish to use the Custom audit level:

1. In the Audit Level menu, select Custom as the audit level.

2. Select the events to audit in the table of events: ■ Click the + sign next to the component name to get the list of audit event categories. ■ Click the + sign next to the category name to get the list of events. ■ Click the + sign next to the event name to get SuccessFailure audit options. 3. Check the Enable Audit box next to the events or categories desired to audit. for example, checking the box next to Security will audit all security events. Checking See Also: Configuring and Managing Auditing in the Oracle Fusion Middleware Application Security Guide. Note: If selected level is Custom, refer to Section 7.4.2.1, Configuring Auditing at the Custom Level .