Log entries fail to capture acr value at INFO level in IDSP

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

You observe that the OPA AuthnPolicy evaluation request log entry in Kibana's ssp_log records the acr (Authentication Context Class Reference) field as null when the logging level is set to the default INFO level. This occurs even when an /authentication request is initiated with a valid acr value in the body payload.

Additionally, you find that:

• The auth-mgr-auth-ext-acr field in the ssp_audit log is empty.
• The actual acr value only appears if you increase the Global Settings log level to DEBUG.

Example request:

curl --location 'https://####/default/auth/v1/authenticate' \\
--header 'Content-Type: application/json' \\
--header 'Host: ####' \\
--header 'User-Agent: ####' \\
--header 'Authorization: Bearer ' \\
--data '{ "subject": "####", "channel": "web", "ipAddress": "####", "action":"authenticate", "acrValues": ["urn:iam:acr:aall:pwd"], "device": { "signature": { "iaAuthData": "####" } } }'

Environment

• Symantec Identity Security Platform (IDSP) 4.0.2
• VIP Authentication Hub

Cause

Engineering confirms this behavior is a limitation in the current logging implementation where specific metadata fields are not captured at the standard INFO level.

Resolution

This issue is targeted to be fixed in release 4.1.1.

If you require immediate visibility of the acr values for troubleshooting or auditing purposes, you must temporarily increase the Global Settings log level to DEBUG.

Note: Increasing log levels to DEBUG in a production environment may impact performance and storage. Ensure you revert to INFO level once your investigation is complete.