How To: Find the Authentication or MFA Method Used During a Login

Version Affected: All

 

Overview

This article explains how to determine which authentication or multi-factor authentication (MFA) method a user used during a specific login, using the realm's audit logs. This is useful when auditing or troubleshooting a realm that requires a second factor.

• Use Method 1 for normal logins through a browser.
• Use Method 2 for API-driven login workflows.
  

In this article

• Method 1: Browser-Based Logins
• Method 2: API-Driven Logins

Method 1: Browser-Based Logins

1. Ensure audit logging is enabled on the realm (Text log or Syslog).
2. Filter the log for EventID 24010. In a text log this appears as <EventID>24010</EventID>; in Syslog it appears as EventID="24010".
3. The authentication method appears inside the <Message> tags in a text log, or the equivalent field in Syslog — for example: Message="Push Notification Method Selected".

Method 2: API-Driven Logins

1. Ensure audit logging is enabled on the realm (Text log or Syslog).
2. Filter the log for EventID 60201. In a text log this appears as <EventID>60201</EventID>; in Syslog it appears as EventID="60201".
3. The authentication method appears immediately after AuthRequestType in the message — for example: "AuthRequestType":"sms".

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.