How to log unauthorised access attempts?

Getting advice
1

Hello,

I would like to audit log every unauthorised access of Keycloak resources. The approach we take in our project is that we implement an EventListenerProvider that audit logs all Keycloak events. The problem is, there is no event emitted by Keycloak for unauthorised access attempt. If a user who has no permission to query clients tries to do so, a user gets 401 Unauthorised, there is no Keycloak event emitted and we cannot log it. Is there any other way we could try logging unauthorised requests?

Thank you,
Oxana

2

There isn’t a good way using Keycloak events. You could enable and use the HTTP logs in order to find all 401s and 403s. You can enable those with the quarkus.properties file, and the following value:

quarkus.http.access-log.enabled=true

See the quarkus guide for more information: