Users & Authentication Audit Events
This page lists audit events related to authenticating Teleport users and Teleport-issued certificates.
auth
Auth Attempt Failed
Example:
{
"code": "T3007W",
"error": "ssh: principal \"fsdfdsf\" not in the set of valid principals for given certificate: [\"root\"]",
"event": "auth",
"success": false,
"time": "2019-04-22T02:09:06Z",
"uid": "036659d6-fdf7-40a4-aa80-74d6ac73b9c0",
"user": "[email protected]"
}
auth_preference.update
Cluster Authentication Preferences Updated
Example:
{
"code": "TCAUTH001I",
"event": "auth_preference.update",
"time": "2020-06-05T16:24:05Z",
"uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
}
cert.create
Certificate Issued
Example:
{
"cert_type": "user",
"code": "TC000I",
"event": "cert.create",
"identity": {
"user": "alice"
},
"time": "2022-02-04T19:43:23.529Z"
}
cert_auth_override.create
Certificate Authority Override Created
Example:
{
"ca_override": {
"ca_type": "windows",
"cluster_name": "zarquon2"
},
"cluster_name": "zarquon2",
"code": "TCO01I",
"ei": 0,
"event": "cert_auth_override.create",
"expires": "0001-01-01T00:00:00Z",
"name": "windows/zarquon2",
"success": true,
"time": "2026-04-08T22:01:00.061Z",
"uid": "dc718618-4e01-4044-b775-065de30dd51a",
"updated_by": "55831da5-8898-4fd2-abe5-8c28c4741534.zarquon2",
"user": "55831da5-8898-4fd2-abe5-8c28c4741534.zarquon2",
"user_cluster_name": "zarquon2",
"user_kind": 3,
"user_roles": [
"Admin"
]
}
cert_auth_override.delete
Certificate Authority Override Deleted
Example:
{
"ca_override": {
"ca_type": "windows",
"cluster_name": "zarquon2"
},
"cluster_name": "zarquon2",
"code": "TCO04I",
"ei": 0,
"event": "cert_auth_override.delete",
"expires": "0001-01-01T00:00:00Z",
"name": "windows/zarquon2",
"success": true,
"time": "2026-04-08T22:04:00.061Z",
"uid": "be0ad673-fdc6-481b-862f-a0447df63dff",
"updated_by": "55831da5-8898-4fd2-abe5-8c28c4741534.zarquon2",
"user": "55831da5-8898-4fd2-abe5-8c28c4741534.zarquon2",
"user_cluster_name": "zarquon2",
"user_kind": 3,
"user_roles": [
"Admin"
]
}
cert_auth_override.update
Certificate Authority Override Updated
Example:
{
"ca_override": {
"ca_type": "windows",
"certificate_overrides": [
{
"certificate": {
"issuer": "CN=Llama Windows CA,OU=Llama CA,O=Llama Corp",
"public_key_hash": "f4522365888fdddcf3c854e79e5928447fe1a2388353efb2f0d30db8ba7c81bc",
"serial_number": "110713595887223080163032262858678558596458745620",
"subject": "CN=zarquon2,O=zarquon2"
}
}
],
"cluster_name": "zarquon2"
},
"cluster_name": "zarquon2",
"code": "TCO02I",
"ei": 0,
"event": "cert_auth_override.update",
"expires": "0001-01-01T00:00:00Z",
"name": "windows/zarquon2",
"success": true,
"time": "2026-04-08T22:02:00.061Z",
"uid": "4e789cfe-069c-46d1-8a44-ce1b2f735e37",
"updated_by": "55831da5-8898-4fd2-abe5-8c28c4741534.zarquon2",
"user": "55831da5-8898-4fd2-abe5-8c28c4741534.zarquon2",
"user_cluster_name": "zarquon2",
"user_kind": 3,
"user_roles": [
"Admin"
]
}
cert_auth_override.upsert
Certificate Authority Override Upserted
Example:
{
"ca_override": {
"ca_type": "windows",
"certificate_overrides": [
{
"certificate": {
"issuer": "CN=Llama Windows CA,OU=Llama CA,O=Llama Corp",
"public_key_hash": "f4522365888fdddcf3c854e79e5928447fe1a2388353efb2f0d30db8ba7c81bc",
"serial_number": "110713595887223080163032262858678558596458745620",
"subject": "CN=zarquon2,O=zarquon2"
}
}
],
"cluster_name": "zarquon2"
},
"cluster_name": "zarquon2",
"code": "TCO03I",
"ei": 0,
"event": "cert_auth_override.upsert",
"expires": "0001-01-01T00:00:00Z",
"name": "windows/zarquon2",
"success": true,
"time": "2026-04-08T22:03:00.061Z",
"uid": "77dcc08b-04e3-4908-b1c8-7836c7b1f057",
"updated_by": "55831da5-8898-4fd2-abe5-8c28c4741534.zarquon2",
"user": "55831da5-8898-4fd2-abe5-8c28c4741534.zarquon2",
"user_cluster_name": "zarquon2",
"user_kind": 3,
"user_roles": [
"Admin"
]
}
login_rule.create
Login Rule Created
Example:
{
"cluster_name": "im-a-cluster-name",
"code": "TLR00I",
"ei": 0,
"event": "login_rule.create",
"expires": "0001-01-01T00:00:00Z",
"name": "test_rule",
"time": "2023-01-25T19:21:36.144Z",
"uid": "266e8563-729e-412f-ba26-1050fbec0cd6",
"user": "nic"
}
login_rule.delete
Login Rule Deleted
Example:
{
"cluster_name": "im-a-cluster-name",
"code": "TLR01I",
"ei": 0,
"event": "login_rule.delete",
"expires": "0001-01-01T00:00:00Z",
"name": "test_rule",
"time": "2023-01-25T19:21:36.144Z",
"uid": "266e8563-729e-412f-ba26-1050fbec0cd6",
"user": "nic"
}
mfa.add
MFA Device Added
Example:
{
"cluster_name": "localhost",
"code": "T1006I",
"mfa_device_name": "usb-c",
"mfa_device_type": "U2F",
"mfa_device_uuid": "7a6fbf23-d75c-4c62-8215-e962d0f2a1f3",
"ei": 0,
"event": "mfa.add",
"time": "2021-03-03T22:58:34.737Z",
"uid": "9be91d9e-79ec-422b-b6ae-ccf7235476d4",
"user": "awly"
}
mfa.delete
MFA Device Deleted
Example:
{
"cluster_name": "localhost",
"code": "T1007I",
"mfa_device_name": "usb-c",
"mfa_device_type": "U2F",
"mfa_device_uuid": "7a6fbf23-d75c-4c62-8215-e962d0f2a1f3",
"ei": 0,
"event": "mfa.delete",
"time": "2021-03-03T22:58:44.737Z",
"uid": "c6afe861-d53c-42ce-837c-7920d2398b44",
"user": "awly"
}
mfa_auth_challenge.create
MFA Authentication Attempt
Example:
{
"challenge_allow_reuse": false,
"challenge_scope": "CHALLENGE_SCOPE_LOGIN",
"cluster_name": "zarq",
"code": "T1015I",
"ei": 0,
"event": "mfa_auth_challenge.create",
"time": "2024-04-16T21:46:59.317Z",
"uid": "815bbcf4-fb05-4e08-917c-7259e9332d69",
"user": "llama",
"user_kind": 1
}
mfa_auth_challenge.validate
There are multiple events with the mfa_auth_challenge.validate type.
T1016I
MFA Authentication Success
Example:
{
"code": "T1016I",
"event": "mfa_auth_challenge.validate",
"time": "2020-06-05T16:24:05Z",
"uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
}
T1016W
MFA Authentication Failure
Example:
{
"code": "T1016W",
"event": "mfa_auth_challenge.validate",
"time": "2020-06-05T16:24:05Z",
"uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
}
privilege_token.create
Privilege Token Created
Example:
{
"cluster_name": "im-a-cluster-name",
"code": "T6002I",
"ei": 0,
"event": "privilege_token.create",
"expires": "2021-11-01T22:29:47.989984Z",
"name": "[email protected]",
"time": "2021-11-01T22:24:47.99Z",
"ttl": "5m0s",
"uid": "6a9d5ac1-08c5-5c1e-9ebd-086d34155b08",
"user": "[email protected]"
}
recovery_code.generated
Recovery Codes Generated
Example:
{
"cluster_name": "im-a-cluster-name",
"code": "T1008I",
"ei": 0,
"event": "recovery_code.generated",
"time": "2021-08-05T21:16:17.13Z",
"uid": "ed0f6962-e34d-5fa4-bd41-7961cf2c51bb",
"user": "[email protected]"
}
recovery_code.used
There are multiple events with the recovery_code.used type.
T1009I
Recovery Code Used
Example:
{
"cluster_name": "im-a-cluster-name",
"code": "T1009I",
"ei": 0,
"event": "recovery_code.used",
"success": true,
"time": "2021-08-05T21:22:46.042Z",
"uid": "4bb44dfe-70dc-5820-8c65-0baf40f62d13",
"user": "[email protected]"
}
T1009W
Recovery Code Use Failed
Example:
{
"cluster_name": "localhost",
"code": "T1009W",
"ei": 0,
"error": "recovery code did not match",
"event": "recovery_code.used",
"message": "recovery code did not match",
"success": false,
"time": "2021-08-05T23:32:41.273Z",
"uid": "714625ab-48d5-51d0-ab1f-c4b267881594",
"user": "[email protected]"
}
recovery_token.create
Recovery Token Created
Example:
{
"cluster_name": "im-a-cluster-name",
"code": "T6001I",
"ei": 0,
"event": "recovery_token.create",
"expires": "2021-08-05T21:56:14.935267Z",
"name": "[email protected]",
"time": "2021-08-05T21:41:14.935Z",
"ttl": "15m0s",
"uid": "29cd2ad5-f1cd-54d2-85fc-4910fbfc9bfa",
"user": "[email protected]"
}
reset_password_token.create
Reset Password Token Created
Example:
{
"code": "T6000I",
"name": "hello",
"event": "reset_password_token.create",
"time": "2020-06-05T16:24:22Z",
"ttl": "8h0m0s",
"uid": "85fef5df-6dca-475e-a049-393f4cf1d6a3",
"user": "b331fb6c-85f9-4cb0-b308-3452420bf81e.one"
}
user.create
User Created
Example:
{
"code": "T1002I",
"connector": "local",
"name": "hello",
"event": "user.create",
"expires": "0001-01-01T00:00:00Z",
"roles": [
"admin"
],
"time": "2020-06-05T16:24:05Z",
"uid": "22a273678c-ee78-5ffc-a298-68a841555c98",
"user": "b331fb6c-85f9-4cb0-b308-3452420bf81e.one"
}
user.delete
User Deleted
Example:
{
"code": "T1004I",
"uid": "b121fc4c-e419-56a2-a760-19cd746c0650",
"time": "2020-06-05T16:24:05Z",
"event": "user.delete",
"name": "bob",
"user": "benarent"
}
user.login
There are multiple events with the user.login type.
T1000I
Local Login
Example:
{
"code": "T1000I",
"event": "user.login",
"method": "local",
"success": true,
"time": "2019-04-22T00:49:03Z",
"uid": "173d6b6e-d613-44be-8ff6-f9f893791ef2",
"user": "[email protected]"
}
T1000W
Local Login Failed
Example:
{
"code": "T1000W",
"error": "user(name=\"fsdfsdf\") not found",
"event": "user.login",
"method": "local",
"success": false,
"time": "2019-04-22T18:06:32Z",
"uid": "597bf08b-75b2-4dda-a578-e387c5ce9b76",
"user": "fsdfsdf"
}
T1010I
SSO Test Flow Login
Example:
{
"attributes": {
"amr": [
"pwd"
],
"at_hash": "7_foQ_0QRVU5dIq_B72_zw",
"aud": "0oa17kaknnntGFKiJ0h8",
"auth_time": 1653294514,
"email": "[email protected]",
"email_verified": true,
"exp": 1653298115,
"groups": [
"Everyone",
"okta-admin",
"okta-dev"
],
"iat": 1653294515,
"idp": "00oafg105f5D4gv5Y0h7",
"iss": "https://dev-813354.oktapreview.com",
"jti": "ID.e_EKsCvMELMLa-Gx0aciOazUvPEFdZSxhTj42zccz3g",
"sub": "00uafg106hK16pwqE0h7",
"ver": 1
},
"cluster_name": "boson.tener.io",
"code": "T1010I",
"ei": 0,
"event": "user.login",
"method": "oidc",
"success": true,
"time": "2022-05-23T08:28:37.067Z",
"uid": "7d440ee1-15f6-4b56-9391-344e8984fd97",
"user": "[email protected]"
}
T1011W
SSO Test Flow Login Failed
Example:
{
"attributes": {
"amr": [
"pwd"
],
"at_hash": "Xz4ibHjouHuIIBOSgWm07w",
"aud": "0oa17kaknnntGFKiJ0h8",
"auth_time": 1653294514,
"email": "[email protected]",
"email_verified": true,
"exp": 1653298153,
"groups": [
"Everyone",
"okta-admin",
"okta-dev"
],
"iat": 1653294553,
"idp": "00oafg105f5D4gv5Y0h7",
"iss": "https://dev-813354.oktapreview.com",
"jti": "ID.h0qtjVPXttmNEHb-yHOvziD20Mru4qiw8L3i74se8YA",
"sub": "00uafg106hK16pwqE0h7",
"ver": 1
},
"cluster_name": "boson.tener.io",
"code": "T1011W",
"ei": 0,
"error": "No roles mapped from claims. The mappings may contain typos.",
"event": "user.login",
"message": "Failed to calculate user attributes.\n\tNo roles mapped from claims. The mappings may contain typos.",
"method": "oidc",
"success": false,
"time": "2022-05-23T08:29:14.126Z",
"uid": "6fa08495-170a-4de9-884f-9931fbdb5982"
}
T1012I
Headless Login Requested
Example:
{
"addr.remote": "1.1.1.1:42",
"code": "T1012I",
"cluster_name": "root.cluster",
"event": "user.login",
"method": "headless",
"ei": 0,
"success": false,
"time": "2019-04-22T00:49:03Z",
"uid": "173d6b6e-d613-44be-8ff6-f9f893791ef4",
"user": "[email protected]"
}
T1013I
Headless Login Approved
Example:
{
"addr.remote": "2.2.2.2:42",
"code": "T1013I",
"cluster_name": "root.cluster",
"event": "user.login",
"method": "headless",
"ei": 0,
"success": true,
"time": "2019-04-22T00:49:03Z",
"uid": "173d6b6e-d613-44be-8ff6-f9f893791ef5",
"user": "[email protected]",
"message": "Headless login was requested from the address 1.1.1.1:42"
}
T1013W
Headless Login Failed
Example:
{
"addr.remote": "2.2.2.2:42",
"code": "T1013W",
"error": "user(name=\"fsdfsdf\") not found",
"cluster_name": "root.cluster",
"event": "user.login",
"method": "headless",
"ei": 0,
"success": false,
"time": "2019-04-22T00:49:03Z",
"uid": "173d6b6e-d613-44be-8ff6-f9f893791ef5",
"user": "[email protected]",
"message": "Headless login was requested from the address 1.1.1.1:42"
}
T1014W
Headless Login Rejected
Example:
{
"addr.remote": "2.2.2.2:42",
"code": "T1014W",
"cluster_name": "root.cluster",
"event": "user.login",
"method": "headless",
"ei": 0,
"success": false,
"time": "2019-04-22T00:49:03Z",
"uid": "173d6b6e-d613-44be-8ff6-f9f893791ef6",
"user": "[email protected]",
"message": "Headless login was requested from the address 1.1.1.1:42"
}
T1001I
SSO Login
Example:
{
"code": "T1001I",
"event": "user.login",
"time": "2020-06-05T16:24:05Z",
"uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
}
T1001W
SSO Login Failed
Example:
{
"code": "T1001W",
"event": "user.login",
"time": "2020-06-05T16:24:05Z",
"uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
}
user.password_change
User Password Updated
Example:
{
"code": "T1005I",
"event": "user.password_change",
"time": "2020-06-05T19:26:53Z",
"uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0",
"user": "Ivan_Jordan"
}
user.update
User Updated
Example:
{
"code": "T1003I",
"event": "user.update",
"name": "bob",
"time": "2020-06-05T16:24:05Z",
"uid": "3a8cd55b5-bce9-5a4c-882d-8e0a5ae10008",
"expires": 111111,
"roles": [
"root"
]
}
user_login.invalid_access_list
Access list skipped.
Example:
{
"code": "TAL009W",
"event": "user_login.invalid_access_list",
"time": "2020-06-05T16:24:05Z",
"uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
}
Was this page helpful?