USER_AUTHENTICATION (100)


The event is generated when a Universal Agent component was not able to successfully authenticate a user identifier and password.

USER_AUTHENTICATION Event Header

Field Name

Description

eventCategory

Security

eventSeverity

Major

eventTopic

User

eventType

100

(Source Fields)

Universal Agent component that encountered the failed user authentication.

(Reporter Fields)

USER_AUTHENTICATION Event Body

Field Name

Notes

Description

certId

1, 2

UACL certificate map identifier to which the client's digital certificate mapped.

clientCertIssuer

1, 2

Issuer field of the digital certificate provided by the client.

clientCertSerialNo

1, 2

Serial number of the digital certificate provided by the client.

clientCertSubject

1, 2

Subject field of the digital certificate provided by the client.

clientIpAddr

1

IP address from which the client's socket connection was established.

clientUserId

1, 3, 4

User identifier of the client.

clientWorkId

1

Work identifier of the client.

userId

3

User identifier that failed authentication.

Notes

  1. Client fields identify the client that requested user authentication. A client is not always the initiator of the authentication request however. Authentication may be performed by a Universal Agent component on its own behalf as part of its normal processing.
  2. Digital certificate information is only provided if the client provided a digital certificate.
  3. A case-dependent value.
  4. A case-dependent value, but for pre-3.2 clients, the value always is considered case sensitive.