io7m | single-page | multi-page | epub | Idstore User Manual 1.0.0-rc0006
9.1. Overview
Previous
9. Security
Up
9.3. General
Next

# 9.2. Security

- 9.2.1. Overview
- 9.2.2. Security Policy Violations
- 9.2.3. Admin Login
- 9.2.4. Admin Login Authentication Failures
- 9.2.5. User Login Rate Limit Violations
- 9.2.6. User Email Verification Rate Limit Violations
- 9.2.7. User Login Authentication Failures
- 9.2.8. User Login
- 9.2.9. User Login Rate Limit Violations
- 9.2.10. User Password Reset Rate Limit Violations

## 9.2.1. Overview

1
All command execution in the idstore server passes through a single code path that captures OpenTelemetry traces and publishes events. Administrators should write alerting rules in their metrics system of choice to watch for instances of the traces, metrics, and events described here; they almost certainly indicate malicious behaviour.
2
At the time of writing, events are published as part of a containing trace, and therefore the server must be configured to publish traces in order for an external monitoring system to be able to observe the events. The reason for this is that the OpenTelemetry Events API specification is not yet stable and so traces are currently the only way to publish events. It is expected that a stable version of the Events API will be released soon, and then the idstore server will switch to using that API directly (and this will require only log telemetry to be configured as opposed to full trace collection).

## 9.2.2. Security Policy Violations

1
If an operation attempts to violate the server's built-in security policy, an exception will be raised with an idstore.errorCode attribute set to error-security-policy-denied.

## 9.2.3. Admin Login

1
If an administrator logs in successfully, the server emits an event of type IdEventAdminLoggedIn. Events of this type have the following attributes:

### 9.2.3.2. IdEventAdminLoggedIn

Attribute | Description | Defined Value
--- | --- | ---
event.domain | The OpenTelemetry event domain. | server
event.name | The OpenTelemetry event name. | security.admin.login.succeeded
idstore.admin | The ID of the administrator. |

## 9.2.4. Admin Login Authentication Failures

1
If someone attempting to log into an administrator account provides invalid credentials, the server emits an event of type IdEventAdminLoginAuthenticationFailed. Events of this type have the following attributes:

### 9.2.4.2. IdEventAdminLoginAuthenticationFailed

Attribute | Description | Defined Value
--- | --- | ---
event.domain | The OpenTelemetry event domain. | server
event.name | The OpenTelemetry event name. | security.admin.login.authentication_failed
idstore.admin | The ID of the administrator. |
idstore.remote_host | The remote host making the attempt. |

## 9.2.5. User Login Rate Limit Violations

1
Login attempts to administrator accounts are rate limited. If a rate limit is exceeded, the server emits an event of type IdEventAdminLoginRateLimitExceeded. Events of this type have the following attributes:

### 9.2.5.2. IdEventAdminLoginRateLimitExceeded

Attribute | Description | Value
--- | --- | ---
event.domain | The OpenTelemetry event domain. | server
event.name | The OpenTelemetry event name. | security.admin.login.rate_limit_exceeded
idstore.remote_host | The remote host making the login attempt. |
idstore.username | The username associated with the login attempt. |

3
In general, if an operation attempts to violate the server's various configured rate limits, an exception will be raised with an idstore.errorCode attribute set to error-rate-limit-exceeded.

## 9.2.6. User Email Verification Rate Limit Violations

1
Attempts to verify email addresses (either to add new addresses, or remove existing addresses) are rate limited. If a rate limit is exceeded, the server emits an event of type IdEventUserEmailVerificationRateLimitExceeded. Events of this type have the following attributes:

### 9.2.6.2. IdEventUserEmailVerificationRateLimitExceeded

Attribute | Description | Defined Value
--- | --- | ---
event.domain | The OpenTelemetry event domain. | server
event.name | The OpenTelemetry event name. | security.user.email.rate_limit_exceeded
idstore.email | The email address. |
idstore.user | The user ID associated with the operation. |

3
In general, if an operation attempts to violate the server's various configured rate limits, an exception will be raised with an idstore.errorCode attribute set to error-rate-limit-exceeded.

## 9.2.7. User Login Authentication Failures

1
If someone attempting to log into an administrator account provides invalid credentials, the server emits an event of type IdEventAdminLoginAuthenticationFailed. Events of this type have the following attributes:

### 9.2.7.2. IdEventAdminLoginAuthenticationFailed

Attribute | Description | Defined Value
--- | --- | ---
event.domain | The OpenTelemetry event domain. | server
event.name | The OpenTelemetry event name. | security.user.login.authentication_failed
idstore.remote_host | The remote host making the attempt. |
idstore.user | The username associated with the attempt. |

## 9.2.8. User Login

1
If an administrator logs in successfully, the server emits an event of type IdEventUserLoggedIn. Events of this type have the following attributes:

### 9.2.8.2. IdEventUserLoggedIn

Attribute | Description | Defined Value
--- | --- | ---
event.domain | The OpenTelemetry event domain. | server
event.name | The OpenTelemetry event name. | security.user.login.succeeded
idstore.user | The ID of the user. |

## 9.2.9. User Login Rate Limit Violations

1
Login attempts to user accounts are rate limited. If a rate limit is exceeded, the server emits an event of type IdEventUserLoginRateLimitExceeded. Events of this type have the following attributes:

### 9.2.9.2. IdEventUserLoginRateLimitExceeded

Attribute | Description | Value
--- | --- | ---
event.domain | The OpenTelemetry event domain. | server
event.name | The OpenTelemetry event name. | security.user.login.rate_limit_exceeded
idstore.remote_host | The remote host making the login attempt. |
idstore.username | The username associated with the login attempt. |

3
In general, if an operation attempts to violate the server's various configured rate limits, an exception will be raised with an idstore.errorCode attribute set to error-rate-limit-exceeded.

## 9.2.10. User Password Reset Rate Limit Violations

1
Password reset attempts to user accounts are rate limited. If a rate limit is exceeded, the server emits an event of type IdEventUserPasswordResetRateLimitExceeded. Events of this type have the following attributes:

### 9.2.10.2. IdEventUserPasswordResetRateLimitExceeded

Attribute | Description | Value
--- | --- | ---
event.domain | The OpenTelemetry event domain. | server
event.name | The OpenTelemetry event name. | security.user.login.rate_limit_exceeded
idstore.remote_host | The remote host making the attempt. |
idstore.target | The username or the email address associated with the attempt (depending on which was specified). |

3
In general, if an operation attempts to violate the server's various configured rate limits, an exception will be raised with an idstore.errorCode attribute set to error-rate-limit-exceeded.
9.1. Overview
Previous
9. Security
Up
9.3. General
Next
io7m | single-page | multi-page | epub | Idstore User Manual 1.0.0-rc0006