Linking SiteMinder and VIP Authentication Hub Logs for MFA Correlation

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

This article describes how to correlate and link logs between SiteMinder and VIP Authentication Hub (IDSP) to track multi-factor authentication (MFA) usage, including phish-resistant factors.

Environment

Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)
SiteMinder (integrated via Authentication Chain)

Resolution

To track and correlate user session activity across both platforms, follow these steps:

1.  Enable the **identity_token_hint** parameter in the SiteMinder and VIP Authentication Hub integration.
2.  Utilize the **Transaction ID** (X-TRANSACTION-ID) which is shared between SiteMinder and VIP AH during the authentication flow.
3.  For detailed configuration steps on enabling session tracking, refer to the official documentation: [Track User Session Activity in the SM-AH Integration](https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/identity-security-platform/4-0/integrating/Integration-of-SiteMinder-with-VIP-Authentication-Hub/track-user-session-activity-in-the-sm-ah-integration.html).
4.  Review the IDSP audit logs for the `eventId: factor.me.auth.complete.success` to find the corresponding `clientTxnId` that matches the SiteMinder transaction context.

For further assistance, refer to [Contact Support](https://support.broadcom.com/web/ecx/contact-support). Scroll to the bottom of the page and click on your respective region to find the appropriate contact details.