Skip to content

Fixes #39512 - Add audit logs for user login/logoff/failed attempts#11097

Open
sbernhard wants to merge 1 commit into
theforeman:developfrom
ATIX-AG:add_user_logging_info_for_audit
Open

Fixes #39512 - Add audit logs for user login/logoff/failed attempts#11097
sbernhard wants to merge 1 commit into
theforeman:developfrom
ATIX-AG:add_user_logging_info_for_audit

Conversation

@sbernhard

@sbernhard sbernhard commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

Successful login:

2026-07-09T10:58:33 [I|app|ba31da65]   Parameters: {"login"=>{"login"=>"admin", "password"=>"[FILTERED]"}, "authenticity_token"=>"EkMyFekuoclH8TxT9dkqnqy3kNKAYuLFlknRwVjnvSRZQEJigWzJsOqn7f8zAu2yAUt7z2ZCY-76iF1G27UyOQ"}
2026-07-09T10:58:33 [I|app|ba31da65] User 'admin' logged in from '192.168.131.101'
2026-07-09T10:58:33 [I|aud|ba31da65] User (4) login event on authentication User 'admin' logged in

Logout:

2026-07-09T10:52:06 [I|app|7f288c89] Processing by UsersController#logout as HTML
2026-07-09T10:52:06 [I|app|7f288c89]   Parameters: {"authenticity_token"=>"0VKhYG4EQkGW2CXlqIg0nEzboJ4xgws2RuPTYCdFeHIJLiwkoeu2Vlp80n9nfGxngI1w--JfppBbdOWyxbkmZw"}
2026-07-09T10:52:06 [I|app|7f288c89] User 'admin' logged out
2026-07-09T10:52:06 [I|aud|7f288c89] User (4) logout event on authentication User 'admin' logged out

Failed login:

2026-07-09T10:57:44 [I|app|7c92de68]   Parameters: {"login"=>{"login"=>"asdfasdf", "password"=>"[FILTERED]"}, "authenticity_token"=>"U30R0dNgfIAc1IYKcdE-XdXHNfz6fvj_owN0-OgKDGCN_Ed4L2YvlMeZ6io4kGjJOGn65ixZN8SGb-x9_912Eg"}
2026-07-09T10:57:44 [I|app|7c92de68] invalid user
2026-07-09T10:57:44 [W|app|7c92de68] Failed login attempt from 192.168.131.101 with username 'asdfasdf'
2026-07-09T10:57:44 [I|aud|7c92de68] User (asdfasdf) failed_login event on authentication Failed login attempt for username 'asdfasdf'

In the UI, it looks like this:
image

@sbernhard
sbernhard force-pushed the add_user_logging_info_for_audit branch from 12c84aa to 720b56f Compare July 9, 2026 12:21
@sbernhard sbernhard changed the title Add audit logs for user login/logoff/failed logins Fixes #39512 - Add audit logs for user login/logoff/failed attempts Jul 9, 2026
Add manual audit events for user authentication activity, covering
successful login, logout, and failed login attempts.

Re-use the method to manually create a Audit event for the user
impersonate method which already created manually an Audit log.

Show failed login attempts for admins without limiting to location /
organization.

Co-authored-by: OpenAI Codex <codex@openai.com>
@sbernhard
sbernhard force-pushed the add_user_logging_info_for_audit branch from 720b56f to eec4b8e Compare July 9, 2026 13:50
@sbernhard
sbernhard marked this pull request as ready for review July 9, 2026 14:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant