How to find out the authentication/MFA method used during login

Version Affected:  All

Description:  

How to find out the MFA method used during logon

Cause:  

When auditing or troubleshooting a realm that requires a second factor it may be necessary to determine which MFA method is being used for each logon attempt.

Resolution:  

For normal workflows interacting with the realm via a browser:

1. Ensure Audit logging is enabled on the realm in question (Text or Syslog).

2. Filter the log for EventID 24010, this will show up in the text log as:

<EventID>24010</EventID>

and Syslog like:

 EventID="24010"

3. The MFA method will show up in between the <Message></Message> tags like the following 5 Text log examples:

<Root><EventID>24010</EventID><Timestamp>10/23/2019 7:49:11 AM</Timestamp><SeverityLevel>Information</SeverityLevel><Priority>3</Priority><UserAgent>Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; WOW64; Trident/7.0; .NET4.0E; .NET4.0C; wbx 1.0.0)</UserAgent><UserHostAddress>172.16.20.228</UserHostAddress><BrowserSession>2a0c0ec0-d18f-4b6f-9e73-170bcf15e1d1</BrowserSession><RequestID>34fc7e84-e3a9-465e-8dad-4ef79ad1201b</RequestID><Realm>SecureAuth68</Realm><Appliance>WIN-122436</Appliance><Company>SecureAuth Support</Company><Version>9.0.1.74</Version><UserID>user1</UserID><Message>PIN Method Selected RegistrationPIN</Message></Root>

<Root><EventID>24010</EventID><Timestamp>10/23/2019 8:20:57 AM</Timestamp><SeverityLevel>Information</SeverityLevel><Priority>3</Priority><UserAgent>Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; WOW64; Trident/7.0; .NET4.0E; .NET4.0C; wbx 1.0.0)</UserAgent><UserHostAddress>172.16.20.228</UserHostAddress><BrowserSession>8d2ba3a9-3d69-490f-a3f4-4ac68dfe1f56</BrowserSession><RequestID>0c6a4c38-318d-4f9d-9a6d-62806da33a3f</RequestID><Realm>SecureAuth68</Realm><Appliance>WIN-122436</Appliance><Company>SecureAuth Support</Company><Version>9.0.1.74</Version><UserID>user1</UserID><Message>Push Notification Method Selected</Message></Root>

<Root><EventID>24010</EventID><Timestamp>10/23/2019 8:22:05 AM</Timestamp><SeverityLevel>Information</SeverityLevel><Priority>3</Priority><UserAgent>Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; WOW64; Trident/7.0; .NET4.0E; .NET4.0C; wbx 1.0.0)</UserAgent><UserHostAddress>172.16.20.228</UserHostAddress><BrowserSession>1dee8e97-bf76-4c81-b0a2-bcfe1a651bd7</BrowserSession><RequestID>f57c9ff6-7d74-4a03-8547-021aa15c8d4a</RequestID><Realm>SecureAuth68</Realm><Appliance>WIN-122436</Appliance><Company>SecureAuth Support</Company><Version>9.0.1.74</Version><UserID>user1</UserID><Message>Push Notification Method Selected</Message></Root>

<Root><EventID>24010</EventID><Timestamp>10/23/2019 8:22:36 AM</Timestamp><SeverityLevel>Information</SeverityLevel><Priority>3</Priority><UserAgent>Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; WOW64; Trident/7.0; .NET4.0E; .NET4.0C; wbx 1.0.0)</UserAgent><UserHostAddress>172.16.20.228</UserHostAddress><BrowserSession>4e875e1d-fed7-4bb8-991d-647091df4d59</BrowserSession><RequestID>18d8be39-70b6-43b5-b573-d50a432cf3a7</RequestID><Realm>SecureAuth68</Realm><Appliance>WIN-122436</Appliance><Company>SecureAuth Support</Company><Version>9.0.1.74</Version><UserID>swatts</UserID><Message>SMS SMethod elected</Message></Root>

<Root><EventID>24010</EventID><Timestamp>10/23/2019 8:23:06 AM</Timestamp><SeverityLevel>Information</SeverityLevel><Priority>3</Priority><UserAgent>Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; WOW64; Trident/7.0; .NET4.0E; .NET4.0C; wbx 1.0.0)</UserAgent><UserHostAddress>172.16.20.228</UserHostAddress><BrowserSession>9119ebd2-18f4-4d59-9102-43d495ec304e</BrowserSession><RequestID>91352c36-606d-4574-ac98-79427733ae9e</RequestID><Realm>SecureAuth68</Realm><Appliance>WIN-122436</Appliance><Company>SecureAuth Support</Company><Version>9.0.1.74</Version><UserID>swatts</UserID><Message>OATH Registration Method Selected</Message></Root>

 and here's some Syslog examples:

Message="Push Notification Method Selected"
Message="OATH Registration Method Selected"

For API workflows:

1. Ensure Audit logging is enabled on the realm in question (Text or Syslog).

2. Filter the log for EventID 60201, this will show up in the text log as:

<EventID>60201</EventID>

and Syslog like:

 EventID="60201"

3. The MFA method will show up in between the <Message></Message> tags and appear similarly in Syslog.  The MFA method can be found immediately following AuthRequestType:

[AuthController].[PostAuthRequestAsync] Auth controller invoked with: '{"UserId":"USERNAME","Domain":null,"Token":"","AuthRequestType":"sms"

Special Considerations:  

For a full list of Audit EventIDs and what they mean see this document here:

https://docs.secureauth.com/pages/viewpage.action?pageId=6226565

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.