PingFederate Server

Administrative API audit log

PingFederate records actions performed through the administrative API in the <pf_install>/pingfederate/log/admin-api.log file.

While the events are not configurable, Log4j 2 configuration settings in the <pf_install>/pingfederate/server/default/conf/log4j2.xml file can be adjusted to deliver the desired level of detail surrounding each event.

Each log entry contains information relating to the event, including:

  • Time the event occurred on the PingFederate server

  • Administrator username performing the action

  • Authentication method

  • Client IP

  • HTTP method

  • REST endpoint

  • HTTP status code

  • jti (JWT ID)

    The jti is the ID of the outbound JSON Web Token (JWT) request. This information is applicable when the PingFederate administrative API authentication scheme is OAuth2 and the client authentication method is private_key_jwt.

  • The hash of the inbound access token

    The hash logging is applicable when the PingFederate administrative API authentication scheme is OAuth2. To calculate the hash value for a token or authorization code, run the calculatehash.sh/bat script in the PingFederate bin folder.
    This feature should only be enabled in production environments when actively troubleshooting authentication issues.

  • HTTP request header

  • TLS version

The <pf_install>/pingfederate/log/admin-api.log does not include the HTTP request header and TLS version values by default. You can customize this log to include additional or less information by modifying the pattern elements in the log4j2.xml file. For more information, see Log4j 2 logging service and configuration.

Each of these fields is separated by a vertical pipe (\|) for ease of parsing.

PingFederate also records actions performed through the administrative API in the <pf_install>/pingfederate/log/admin.log file. For more information, see Administrator audit logging.