anchor.diff:  ---
  -title: User Account and Authentication Service Audit Requirements
  +title: UAA Audit Requirements
   owner: UAA
   ---
   
  
positive.code: UAA includes the following client administration events:
  
  * ClientCreateSuccess
      - Happens: When a client is created
      - Data Recorded: Client ID, Scopes, Authorities
  
  * ClientUpdateSuccess
      - Happens: When a client is updated
      - Data Recorded: Client ID, Scopes, Authorities
  
  * SecretChangeFailure
      - Happens: When a client secret fails to change
      - Data Recorded: Client ID
  
  * SecretChangeSuccess
      - Happens: When a client secret is changed
      - Data Recorded: Client ID
  
  * ClientApprovalsDeleted
      - Happens: When all approvals for a client are deleted
      - Data Recorded: Client ID
  
  * ClientDeleteSuccess
      - Happens: When a client is deleted
      - Data Recorded: Client ID
  
  
  ## <a id="uaa-admin-events"></a>UAA Administration Events
  
negative.code: UAA includes the following UAA administration events:
  
  * ServiceProviderCreatedEvent
      - **Trigger:** When managing the details of an external service provider which uses the UAA as a SAML IDP
      - **Data Recorded:** Principal ID (client or user ID), Service Provider
  
  * ServiceProviderModifiedEvent
      - **Trigger:** When managing the details of an external service provider which uses the UAA as a SAML IDP
      - **Data Recorded:** Principal ID (client or user ID), Service Provider
  
  * IdentityZoneCreatedEvent
      - **Trigger:** When identity zone is created in the UAA
      - **Data Recorded:** Principal ID (client or user ID), Identity Zone
  
  * IdentityZoneModifiedEvent
      - **Trigger:** When managing the configuration of identity zones in the UAA
      - **Data Recorded:** Principal ID (client or user ID), Identity Zone
  
  * IdentityProviderCreatedEvent
       - **Trigger:** When configuring the UAA to authenticate with an external IDP such as SAML or LDAP
       - **Data Recorded:** Principal ID (client or user ID), Identity Provider
  
  * IdentityProviderModifiedEvent
       - **Trigger:** When configuring the UAA to authenticate with an external IDP such as SAML or LDAP
       - **Data Recorded:** Principal ID (client or user ID), Identity Provider
  
  * EntityDeletedEvent
       - **Trigger:** When an identity provider or identity zone is deleted
       - **Data Recorded:** Principal ID (client or user ID), Deleted entity
  
  ## <a id="flows"></a>Flows
  
  Below are some example flows for a UAA configured with LDAP as an IDP:
  
  * Browser flows
       - **Successful login:** UserNotFound -> PrincipalAuthenticationFailure -> UserCreatedEvent -> IdentityProviderAuthenticationSuccess -> UserAuthenticationSuccess
       - **Invalid password:** UserNotFound -> PrincipalAuthenticationFailure -> IdentityProviderAuthenticationFailure
       - **Unknown user:** UserNotFound -> PrincipalAuthenticationFailure -> IdentityProviderAuthenticationFailure
  
  * Password grant
       - **Successful login:** ClientAuthenticationSuccess -> UserNotFound -> PrincipalAuthenticationFailure -> IdentityProviderAuthenticationSuccess -> UserAuthenticationSuccess -> TokenIssuedEvent
       - **Invalid password:** ClientAuthenticationSuccess -> UserNotFound -> PrincipalAuthenticationFailure -> IdentityProviderAuthenticationFailure
       - **Unknown user:** ClientAuthenticationSuccess -> UserNotFound-> PrincipalAuthenticationFailure -> IdentityProviderAuthenticationFailure