## 7.1.5.2 Auditing and Logging Information for SAP Authorization and Trust Management Service
Here you can find a list of the security events that are logged by SAP Authorization and Trust Management service (XSUAA). These events are provided in addition to the events of the Cloud Foundry User Account and Authentication service (UAA).
## Troubleshoot Identity Provider Issues
To help troubleshoot issues with the identity provider, use tools depending on the trust configuration:
For SAML identity providers, you can use the network trace of your browser. For more information, see 2461862 .
For OIDC identity providers, use the troubleshooting tools of the identity provider. For SAP Cloud Identity Services, see Logging OpenID Connect Tokens.
## Security Events of the User Account and Authentication Service
For information about the security events of the UAA, see UAA Audit Requirements in the Cloud Foundry documentation.
## Security Events of the SAP Authorization and Trust Management Service
The SAP Authorization and Trust Management service uses role collections to handle account management.
SAP Authorization and Trust Management service records all its changes in its database tables and summarizes these changes in the audit log. The following table summarizes the audit log entries.
##  Note
UNKNOWN\_USER in an audit log message is a placeholder, which usually appears when logs are written for flows that don't involve users, for example, client credential flows.
Security Events Written in Audit Logs
| Event grouping                 | What events are logged                 | How to identify related log events                                          | Additional information                                                                                  |
|--------------------------------|----------------------------------------|-----------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------|
| Identity provider manage- ment | Trust identity provider.               | object with type "IdentityProvider" and id consisting of: crudType "CREATE" | Attributes of the identity pro- vider.                                                                  |
|                                |                                        | tableName "xs_tenant", crudType "UPDATE"                                    | Trusting an identity provider using OpenID Connect trig- gers a change in the XSUAA tenant.             |
|                                | Update trust with identity provider.   | object with type "IdentityProvider" and id consisting of: crudType "UPDATE" | Old attributes of the iden- tity provider and any attrib- utes required to identify the changes.        |
|                                |                                        | tableName "xs_tenant", crudType "UPDATE"                                    | Updating trust in an identity provider using OpenID Con- nect can trigger a change in the XSUAA tenant. |
|                                | Delete trust with identity pro- vider. | object with type "IdentityProvider" and id consisting of: crudType "DELETE" | Attributes of the service in- stance.                                                                   |
|                                |                                        | tableName "xs_tenant", crudType "UPDATE"                                    | Removing trust in an identity provider using OpenID Con- nect triggers a change in the XSUAA tenant.    |
How to identify related log
| Event grouping      | What events are logged   | events                                                                                                                                                    | Additional information                                                                          |
|---------------------|--------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------|
| Instance management | Create instance.         | Attribute with name "complete" and value ""ServiceInstanceId : <Instance_ID> … object with type "<Instance_Name>" and id consisting of: crudType "CREATE" | Attributes of the service in- stance.                                                           |
|                     | Update instance.         | Attribute with name "complete" and value ""ServiceInstanceId : <Instance_ID> object with type "<Instance_Name>" and id consisting of: crudType "UPDATE"   | Old attributes of the serv- ice instance and any attrib- utes required to identify the changes. |
|                     | Delete instance.         | Attribute with name "complete" and value ""ServiceInstanceId : <Instance_ID> … object with type "<Instance_Name>" and id consisting of: crudType "DELETE" | Attributes of the service in- stance.                                                           |
##  Note
If you create a new binding secret for the service instance, a new binding entry is created in the SAP Authorization and Trust Management service. This entry then appears in the audit log of the subaccount of the service instance. The audit log of the subaccount of the reuse service itself isn't affected.
How to identify related log
| Event grouping             | What events are logged             | events                                                                                                                                                                                                    | Additional information                                                                                                                                                                                                                                                |
|----------------------------|------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Role collection management | Create role collection.            | tableName "xsrolecollections" , crudType "CREATE" audit.configuration                                                                                                                                     | Other attributes: • Timestamp • Origin key • Role collection name • Zone ID                                                                                                                                                                                           |
|                            | Assign users to role collec- tion. | Direct assignment to users: tableName "xs_rolecollection2 user", crudType "CREATE" Mapping to users with attrib- utes: tableName "xsrolecollection2s amlattribute", crudType "CREATE" audit.configuration | Other attributes for direct as- signment: • Timestamp • Origin key • User SCIM ID • Zone ID • Role collection name Other attributes for mapping: • Timestamp • Origin key • Attribute name • Attribute value • Identity provider URL • Zone ID • Role collection name |
|                            | Assign roles to role collec- tion. | tableName "xsrolecollection2r ole", crudType "CREATE"                                                                                                                                                     | • Timestamp • Origin key • Role name • Role zone ID • Role template name • Role collection zone ID • Role template app ID • Role collection name                                                                                                                      |
|                            | Delete role collection.            | tableName "xsrolecollections" , crudType "DELETE" audit.configuration                                                                                                                                     | Other attributes: • Timestamp • Origin key • Role collection name • Zone ID                                                                                                                                                                                           |
| Event grouping                       | What events are logged                                                                                                                                                                                                                      | How to identify related log events                                                                                                                               | Additional information                                                                                                                                                                                                                                                                                     |
|--------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Role management                      | Create role.                                                                                                                                                                                                                                | tableName "xsrole", crudType "CREATE" audit.configuration                                                                                                        | Other attributes: • Timestamp • Origin key • App ID • Role name • Role template name • Zone ID                                                                                                                                                                                                             |
|                                      | Modify attribute values in role.                                                                                                                                                                                                            | tableName "xsattribute2role", crudType "CREATE" audit.configuration                                                                                              | Other attributes: • Timestamp • Origin key • Role name • Zone ID • Attribute app ID • Role template name • Attribute name • Attribute value • Role template app ID                                                                                                                                         |
|                                      | Delete role.                                                                                                                                                                                                                                | tableName "xsrole", crudType "DELETE" audit.configuration                                                                                                        | Other attributes: • Timestamp • Origin key • Role template app ID • Role name • Role template name • Zone ID                                                                                                                                                                                               |
| Emergency administrator as- signment | Assign global account or subaccount administrator in case of an emergency  Example • Assignment of a subaccount admin- istrator by a global account administra- tor • Assignment of a global account ad- ministrator by an authorized user | "crudType":"CREATE" ,"type":"Global Account Administrator assignment" or "crudType":"CREATE" ,"type":"Subaccount Administrator assignment" audit.security-events | The user who assigned the permission is identified by the user name and by the origin key (such as sap.default for the default identity provider). Further information included in the log: • Initiating user name • Initiating user origin • New administrator's user name • New administrator's ori- gin |
| Event grouping      | What events are logged                                                                                                                                                                                                                                                                                                       | How to identify related log events                                                                                                                                                                                                                                                                                           | Additional information                                                                                                                                                                                                                                                                                                                                                                                                                     |
|---------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Token Embedding     | Embedding error                                                                                                                                                                                                                                                                                                              | Error during handling of IAS Tokens for embedding. audit.security-events                                                                                                                                                                                                                                                     | Occurs when an error oc- curs when attempting to ex- change a token for a to- ken with an embedded to- ken from SAP Cloud Identity Services or a corporate iden- tity provider. Check the con- figuration of the application. For more information, see In- clude Tokens from Corporate Identity Providers or SAP Cloud Identity Services in To- kens of the SAP Authoriza- tion and Trust Management Service [page 571].                  |
|                     |  Caution Be prepared for the possibility that the initial token retrieval might not include the corporate identity provider token. In such a case, a retry is recommended. However, keep in mind that even the retry might not yield the desired token, so ensure your application can handle this situation appropriately. |  Caution Be prepared for the possibility that the initial token retrieval might not include the corporate identity provider token. In such a case, a retry is recommended. However, keep in mind that even the retry might not yield the desired token, so ensure your application can handle this situation appropriately. |  Caution Be prepared for the possibility that the initial token retrieval might not include the corporate identity provider token. In such a case, a retry is recommended. However, keep in mind that even the retry might not yield the desired token, so ensure your application can handle this situation appropriately.                                                                                                               |
| SAML authentication | Authentication error                                                                                                                                                                                                                                                                                                         | SAMLAuthenticationE rror Response issue time is either too old or with date in the future. Sync IdP to match skew <skew> audit.security-events                                                                                                                                                                               | Occurs when the time skew between SAP Authorization and Trust Management service and the identity pro- vider is larger than 60 sec- onds. Or the authentication response took more than 60 seconds to reach the SAP Authorization and Trust Management service after being issued. Check the time skew be- tween the identity provider and SAP Authorization and Trust Management service. Synchronize the clock of the identity provider. |
How to identify related log
| Event grouping   | What events are logged   | events                                                                                                         | Additional information                                                                                                                                                                                                                                                                                                        |
|------------------|--------------------------|----------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|                  |                          | SAMLAuthenticationE rror Unexpected AuthnResponse : Existing authentication - <user> audit.security-events     | The user has probably chosen the back button on the browser, triggering a second authentication re- quest to the identity pro- vider with the same user ID. The identity provider issues a second authentication re- sponse for the same user ID. SAP Authorization and Trust Management service rejects duplicate responses. |
|                  |                          | SAMLAuthenticationE rror AuthnRequest expired - ID: <request_id> Destination: <identity_provider_ destination> | Occurs when an authentica- tion response from an iden- tity provider takes more than 15 minutes. If this error occurs consis- tently, check why the identity provider needs more than 15 minutes to issue an authenti- cation response.                                                                                       |
|                  |                          | audit.security-events SAMLAuthenticationE rror InResponseToField of Response doesn't correspond to the         | Occurs when a user attempts to log on or refresh a session for which the authentication request has expired, for ex- ample, if this message is pre- ceded by AuthnRequest                                                                                                                                                     |
|                  |                          | audit.security-events SAMLAuthenticationE rror No valid credential to evaluate the                             | Occurs when the certificate used to sign the SAML re- sponse isn't valid.                                                                                                                                                                                                                                                     |
|                  |                          | token audit.security-events                                                                                    |                                                                                                                                                                                                                                                                                                                               |
| Event grouping   | What events are logged   | How to identify related log events                              | Additional information                                                                                                                                                                                                                             |
|------------------|--------------------------|-----------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|                  | Authentication success   | UserAuthenticationS uccess audit.security-events                | These entries are in addi- tion to the entries made by the UAA. See the previous section Security Events of the User Account and Authentication Service . Authentication success in- cludes: • User name • Principle (SCIM user ID) • Origin key   |
|                  | SAML responses           | "msgNo":<index>,"ms gId":"<message_id>" , audit.security-events | Weinclude SAML responses in the audit log for web single sign-on and SAML bearer as- sertions.                                                                                                                                                     |
|                  |                          |                                                                 |  Note When messages exceed 4k, we break the mes- sages into multiple en- tries. Weidentify each message with a msgId GUID and the parts with a msgNo index. To view the whole SAML re- sponse, gather the parts and stitch the contents together. |