Authentication Events

Article Type: Concept
Audience: Enterprise Administrators
Module: Enterprise Admin - Access Control
Applies to Versions: All Versions

1. Overview

The Authentication Events screen provides Enterprise Administrators with comprehensive visibility into all authentication activities across the entire Fuuz Enterprise. This centralized security audit log captures every authentication attempt, API key generation, token verification, and identity provider interaction for all users, applications, and systems within your organization.

Authentication Events serve as the primary tool for security investigations, compliance auditing, troubleshooting user access issues, and monitoring potential security threats. All events are logged in real-time with 180-day retention and can be exported without row limits for external analysis or long-term archival.

Who Should Use This Feature

• Enterprise Administrators: Primary security and compliance monitoring
• Security Teams: Investigating suspicious authentication patterns or security incidents
• Compliance Officers: Generating audit reports for SOC 2, ISO 27001, and regulatory requirements
• IT Support: Troubleshooting user login and access issues
• API Administrators: Monitoring API key usage and authentication failures

Common Use Cases

• Troubleshooting user login issues and account lockouts
• Security investigations following suspected breaches or unusual activity
• Audit compliance reporting for regulatory frameworks
• Monitoring API usage patterns and authentication failures
• Tracking user access across applications and environments
• Identifying compromised credentials or brute force attacks
• Verifying identity provider integration functionality

2. Architecture & Data Flow

Event Logging Architecture

Authentication Events are captured at the enterprise service mesh layer, ensuring comprehensive logging regardless of the authentication method, application, or entry point. Every authentication attempt generates an event record that includes timestamp, event type, status, user information, IP address (for external logins), identity provider, and failure reason (if applicable).

Events are logged synchronously in real-time, meaning that as soon as an authentication attempt completes, the event is immediately available in the Authentication Events screen. There is no batch processing delay or asynchronous logging queue that might delay event visibility.

Authentication Event Types

Event Statuses

• Success: Authentication attempt completed successfully and access was granted
• Failure: Authentication attempt failed due to invalid credentials, expired tokens, or other authentication errors
• Incomplete: Authentication process started but did not complete (user abandoned, timeout, system error)

Failure Reasons

Failure reasons are captured as free-text descriptions that provide specific detail about why an authentication attempt failed. Common failure reasons include:

• Authentication failed: jwt expired - JWT token has exceeded its validity period
• jwt expired - Shortened form indicating token expiration
• Invalid credentials - Username or password incorrect
• Account locked - User account locked due to failed attempts
• API key invalid - API key does not exist or has been revoked
• Additional system-generated messages describing specific authentication failures

Account Lockout Mechanism

The Fuuz Platform implements automatic account lockout protection to prevent brute force attacks. After 5 consecutive failed login attempts, the user account is automatically locked and cannot authenticate until an Enterprise Administrator manually unlocks the account through the Enterprise Users screen.

3. Use Cases

Security Investigation

Scenario: Multiple failed login attempts detected from unfamiliar IP addresses

Investigation Steps:

1. Filter Authentication Events by Status = Failure and Event Type = InvalidAuthentication
2. Review IP Address column to identify suspicious source locations
3. Check Username column to determine if attacks target specific accounts or are random
4. Export filtered results to CSV for detailed analysis and reporting
5. If compromised credentials suspected, immediately reset affected user passwords
6. Set up Data Flow alert to notify security team of future high-frequency failures from same IP ranges

Troubleshooting User Access Issues

Scenario: User reports inability to log in and receiving error messages

Troubleshooting Steps:

1. Navigate to Authentication Events and search for the user by username or select from User dropdown
2. Review recent authentication attempts to identify failure patterns
3. Check Failure Reason column for specific error messages (expired token, invalid credentials, account locked)
4. If account locked, navigate to Enterprise Users screen to unlock the account
5. If repeated VerifyTokenExpired events, advise user to clear browser cache and re-login
6. If API key issues, verify API key is valid and has not been revoked

Compliance Audit Reporting

Scenario: Annual SOC 2 audit requires evidence of authentication monitoring and access control

Reporting Steps:

1. Set date range to cover the audit period (e.g., January 1 - December 31)
2. Export all authentication events to Excel for comprehensive audit trail
3. Filter by specific Applications or Users if audit scope is limited
4. Generate summary reports showing total authentication attempts, success rate, and lockout incidents
5. Document account lockout mechanism and administrative unlock procedures
6. Provide evidence of real-time logging and 180-day retention policy

API Usage Monitoring

Scenario: Monitor API key authentication patterns to identify unusual usage or potential API key compromise

Monitoring Steps:

1. Filter by Event Type = VerifyApiKey to isolate API authentication events
2. Review User Api Key column to track usage of specific API keys
3. Check IP Address patterns for unexpected geographic locations
4. Monitor for high-frequency API calls that might indicate automated attacks or runaway processes
5. Filter by Status = Failure to identify API keys that are no longer valid
6. Set up Data Flow to export API authentication events to external monitoring system

Identity Provider Verification

Scenario: Verify that OIDC or SAML identity provider integration is functioning correctly

Verification Steps:

1. Filter by Identity Provider column to view authentication events for specific IdP
2. Review success vs failure rates to identify integration issues
3. Check that external IdP users show correct Identity Provider (not "Internal")
4. Verify token refresh patterns are consistent with IdP token expiration settings
5. Monitor for VerifyTokenExpired events that might indicate IdP token lifecycle issues

4. Screen Details

Accessing Authentication Events

Navigation Path:

Enterprise Admin Home → System → Access Control → Authentication Events

Required Permissions:

• Access Type: Enterprise Admin (exclusive access - not available to App Admins or Developers)
• Visibility Scope: All Organizations and Applications across the entire Enterprise

Filter Options

Table Columns

Export Functionality

Authentication Events can be exported to CSV or Excel formats for external analysis, archival, or integration with other systems. There are no row limits on exports - the system will export all records matching your current filter criteria regardless of volume.

Export Process:

1. Apply desired filters to narrow the data set (recommended for large exports)
2. Click the export button in the toolbar
3. Select CSV or Excel format
4. Download file will include all columns and all rows matching the filter

5. Technical Details

Data Retention Policy

Authentication Events are retained for 180 days from the date the event was created. After 180 days, events are automatically purged from the system. Organizations requiring longer retention periods should implement automated export workflows using Data Flows to archive authentication data to external systems or data warehouses.

Real-Time Event Logging

All authentication events are logged synchronously in real-time. When an authentication attempt completes, the event record is immediately written to the authentication log and is instantly available in the Authentication Events screen. There is no batch processing delay or queuing mechanism that might defer event visibility.

This real-time architecture ensures that security investigations and troubleshooting activities have access to the most current authentication data without waiting for log processing cycles.

IP Address Tracking

IP addresses are captured for all external authentication attempts initiated from client browsers or external API consumers. Internal service-to-service authentication (such as Gateway-to-Platform or scheduled Data Flow execution) does not capture IP addresses since these requests originate from within the platform infrastructure.

The IP Address field is valuable for identifying geographic patterns in authentication attempts, detecting suspicious login locations, and correlating failed authentication attempts from specific IP ranges that might indicate coordinated attacks.

Identity Provider Integration

Any identity provider configured for your Enterprise will appear in the Identity Provider column and filter options. This includes:

• Internal: Standard Fuuz username/password authentication
• OIDC Providers: OpenID Connect integrations (Azure AD, Okta, Google Workspace, etc.)
• SAML Providers: SAML 2.0 enterprise identity providers
• Custom IdPs: Any organization-specific identity provider configurations

Each configured identity provider will display using the name assigned during the IdP configuration process, making it easy to filter and analyze authentication patterns by provider.

Alert and Notification Integration

Administrators can establish automated alerting for authentication events using Data Flows. Common alerting patterns include:

• High-Frequency Failures: Alert when more than X failed attempts occur within Y minutes
• Geographic Anomalies: Notify when authentication attempts originate from unexpected IP ranges or countries
• Account Lockouts: Immediate notification when user accounts are automatically locked
• API Key Issues: Alert on repeated API key authentication failures
• After-Hours Access: Notify on authentication attempts outside of normal business hours

Data Flows can also push authentication events to external systems including SIEM platforms, compliance databases, or ticketing systems for centralized security monitoring.

Compliance and Audit Requirements

Authentication Events fulfill audit logging requirements for multiple compliance frameworks:

• SOC 2 Type II: Demonstrates comprehensive logging and monitoring of logical access controls
• ISO 27001: Provides evidence of access control monitoring and security event logging
• GDPR: Supports data access auditing and breach detection requirements
• HIPAA: Documents access attempts to systems containing protected health information
• NIST 800-53: Satisfies audit and accountability control families

The real-time logging, comprehensive event capture, and exportability features ensure that Authentication Events meet the most stringent audit and compliance requirements across industries.

6. Resources

Related Articles

Enterprise Admin:

• Enterprise Admin Overview
• Enterprise Users Management
• Access Control Policies
• Identity Provider Configuration (OIDC/SAML)
• API Key Management

Security & Compliance:

• Security Best Practices
• Account Lockout and Recovery Procedures
• Compliance Reporting Guide
• Data Flow Alert Configuration

Integration:

• Data Flow Connectors Overview
• Exporting Data to External Systems
• SIEM Integration Patterns

7. Troubleshooting

8. Revision History