Identity & Account Events
Identity events help administrators distinguish a login attempt, a directory synchronization result, and an account lockout. Use the provider, user, time, and event type to identify the record for the question you are investigating. A completed file action is recorded separately in Activity History; administrative changes belong in Settings Changes.
SSO Events and User Security Events are retained for 90 days.
SSO and LDAP Events
SSO Events record activity from your identity integrations: SAML login attempts, LDAP login attempts, and LDAP sync operations. Use these logs to investigate authentication failures, review sync results, and audit login activity across your SSO providers.
For configuration details on your SSO integrations, see SSO / Single Sign-On.
SSO Events cover three distinct event types.
SAML Login events record each attempt by a user to authenticate using SAML. The Username on Files.com field shows the user's Files.com username, and the IdP UID field shows the identifier returned by the identity provider. Use these fields to identify the account and the provider's identity for the login attempt.
LDAP Login events record each attempt by a user to authenticate using LDAP. A login event captures the outcome of the authentication request and any error information returned by the LDAP provider.
LDAP Sync events record each attempt to synchronize user and group provisioning information from your LDAP server. A sync event captures whether the synchronization succeeded, partially succeeded, or failed, along with any error details.
SSO Email Alerts
Site Administrators can receive email alerts for LDAP sync failures through the SSO/SCIM/LDAP configuration/sync failures preference in their account settings. This preference covers LDAP sync failure and partial-failure events only. LDAP login failures and SAML login failures are not included in the broad email preference. To receive alerts for those event types, configure an Event Channel subscription for LDAP login failures or SAML login failures.
Details Recorded in SSO Events
Each SSO Event entry includes the following columns.
| Column | Details |
|---|---|
| ID | ID of the event. Click on the ID to see more details. |
| Event Type | The type of SSO event: SAML Login, LDAP Login, or LDAP Sync. |
| Status | Status of the event: Success, Failure, or Partial_failure. |
| Username | The user's Files.com username. |
| IdP UID | The identifier returned by the identity provider (SAML login events). |
| Provider | The SSO provider associated with the event. |
| IP | IP address of the login request (login events). |
| Date | Time the event occurred. |
Account Lockouts
User Security Events record when an account is locked after too many consecutive failed login attempts.
For the security settings that govern lockout behavior, see Security Settings. To unlock a user account, see Unlocking Users.
Lockout events record when a user account is locked due to repeated failed login attempts. The event captures the affected user and the time the lockout occurred. User security events do not have a status field; the event itself indicates the lockout condition.
Lockout Email Alerts
Site Administrators can receive email alerts for user lockout events through the User security events preference in their account settings.
Details Recorded in User Security Events
Each User Security Event entry includes the following columns.
| Column | Details |
|---|---|
| ID | ID of the event. Click on the ID to see more details. |
| Event Type | The type of security event. Lockout. |
| User | The user account that was locked. |
| Date | Time the event occurred. |