How to find out the authentication/MFA method used during login

Follow

Version Affected:  All

Description:  

How to find out the MFA method used during logon

 

Cause:  

When auditing or troubleshooting a realm that requires a second factor it may be necessary to determine which MFA method is being used for each logon attempt.

 

Resolution:  

1. Ensure Audit logging is enabled on the realm in question (Text or Syslog).

2. Filter the log for EventID 24010, this will show up in the text log as:

<EventID>24010</EventID>

and Syslog like:

 EventID="24010"

3. The MFA method will show up in between the <Message></Message> tags like the following 5 Text log examples:

<Root><EventID>24010</EventID><Timestamp>10/23/2019 7:49:11 AM</Timestamp><SeverityLevel>Information</SeverityLevel><Priority>3</Priority><UserAgent>Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; WOW64; Trident/7.0; .NET4.0E; .NET4.0C; wbx 1.0.0)</UserAgent><UserHostAddress>172.16.20.228</UserHostAddress><BrowserSession>2a0c0ec0-d18f-4b6f-9e73-170bcf15e1d1</BrowserSession><RequestID>34fc7e84-e3a9-465e-8dad-4ef79ad1201b</RequestID><Realm>SecureAuth68</Realm><Appliance>WIN-122436</Appliance><Company>SecureAuth Support</Company><Version>9.0.1.74</Version><UserID>user1</UserID><Message>PIN Method Selected RegistrationPIN</Message></Root>

<Root><EventID>24010</EventID><Timestamp>10/23/2019 8:20:57 AM</Timestamp><SeverityLevel>Information</SeverityLevel><Priority>3</Priority><UserAgent>Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; WOW64; Trident/7.0; .NET4.0E; .NET4.0C; wbx 1.0.0)</UserAgent><UserHostAddress>172.16.20.228</UserHostAddress><BrowserSession>8d2ba3a9-3d69-490f-a3f4-4ac68dfe1f56</BrowserSession><RequestID>0c6a4c38-318d-4f9d-9a6d-62806da33a3f</RequestID><Realm>SecureAuth68</Realm><Appliance>WIN-122436</Appliance><Company>SecureAuth Support</Company><Version>9.0.1.74</Version><UserID>user1</UserID><Message>Push Notification Method Selected</Message></Root>

<Root><EventID>24010</EventID><Timestamp>10/23/2019 8:22:05 AM</Timestamp><SeverityLevel>Information</SeverityLevel><Priority>3</Priority><UserAgent>Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; WOW64; Trident/7.0; .NET4.0E; .NET4.0C; wbx 1.0.0)</UserAgent><UserHostAddress>172.16.20.228</UserHostAddress><BrowserSession>1dee8e97-bf76-4c81-b0a2-bcfe1a651bd7</BrowserSession><RequestID>f57c9ff6-7d74-4a03-8547-021aa15c8d4a</RequestID><Realm>SecureAuth68</Realm><Appliance>WIN-122436</Appliance><Company>SecureAuth Support</Company><Version>9.0.1.74</Version><UserID>user1</UserID><Message>Push Notification Method Selected</Message></Root>

<Root><EventID>24010</EventID><Timestamp>10/23/2019 8:22:36 AM</Timestamp><SeverityLevel>Information</SeverityLevel><Priority>3</Priority><UserAgent>Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; WOW64; Trident/7.0; .NET4.0E; .NET4.0C; wbx 1.0.0)</UserAgent><UserHostAddress>172.16.20.228</UserHostAddress><BrowserSession>4e875e1d-fed7-4bb8-991d-647091df4d59</BrowserSession><RequestID>18d8be39-70b6-43b5-b573-d50a432cf3a7</RequestID><Realm>SecureAuth68</Realm><Appliance>WIN-122436</Appliance><Company>SecureAuth Support</Company><Version>9.0.1.74</Version><UserID>swatts</UserID><Message>SMS SMethod elected</Message></Root>

<Root><EventID>24010</EventID><Timestamp>10/23/2019 8:23:06 AM</Timestamp><SeverityLevel>Information</SeverityLevel><Priority>3</Priority><UserAgent>Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; WOW64; Trident/7.0; .NET4.0E; .NET4.0C; wbx 1.0.0)</UserAgent><UserHostAddress>172.16.20.228</UserHostAddress><BrowserSession>9119ebd2-18f4-4d59-9102-43d495ec304e</BrowserSession><RequestID>91352c36-606d-4574-ac98-79427733ae9e</RequestID><Realm>SecureAuth68</Realm><Appliance>WIN-122436</Appliance><Company>SecureAuth Support</Company><Version>9.0.1.74</Version><UserID>swatts</UserID><Message>OATH Registration Method Selected</Message></Root>

 and here's some Syslog examples:

Message="Push Notification Method Selected"
Message="OATH Registration Method Selected"

 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.

0 out of 0 found this helpful

Comments

0 comments

Please sign in to leave a comment.