Accessing LDAP/AD/SAML Logs
All queries sent to the configured LDAP/AD server can be logged. To enable this feature:
- SSH into the Controller host.
- Execute either of the following commands, as appropriate:
- LDAP/AD:
/opt/bluedata/common-install/bd_mgmt/bin/bd_mgmt enable_management_logger authaudit
- SAML:
/opt/bluedata/common-install/bd_mgmt/bin/bd_mgmt enable_management_logger samldebug
- LDAP/AD:
- To locate LDAP/AD queries, search
/var/log/bluedata/bds-mgmt.log
for all instances ofauthaud
(LDAP/AD) orsamldeb
(SAML).
This feature logs the following LDAP/AD activity:
- An LDAP/AD user who does not have an existing session attempts to log in.
- A Platform Administrator changes the LDAP/AD authentication parameters.
- A Platform Administrator verifies the LDAP/AD authentication parameters.
- A user is added who is being authenticated by an external LDAP/AD server.
This feature does not log the following activity because it does not require querying the LDAP/AD server:
- An authenticated user attempts to log in.
- A user is added who is not being authenticated by an external LDAP/AD server.
- A user is assigned a role within a tenant or project.