SSO Audit Logging

SSO Audit Logging#

SsoAuditLog is an ActiveRecord model that persists security-significant SSO events to the sso_audit_logs table. It is the single audit trail for all OIDC/SSO activity in Sure and is distinct from general session management (which uses cookies/tokens) and the SSO authentication flow itself (which covers the OIDC handshake).

Schema#

The table was introduced in migration 20260103170412 with UUID primary keys and the following columns :

Column	Type	Notes
`id`	UUID	Primary key
`user_id`	UUID (FK, nullable)	`null: true` — allows logging failed logins with no associated user
`event_type`	string (not null)	One of the 7 event types below
`provider`	string	IdP identifier (e.g. `"google"`)
`ip_address`	string	`request.remote_ip`
`user_agent`	string	Truncated to 500 chars
`metadata`	jsonb	Default `{}`, free-form additional context
`created_at` / `updated_at`	timestamps	—

Indexes exist on event_type, created_at, and [user_id, created_at] , supporting efficient per-user and time-range queries.

Event Types & Class Methods#

Seven event types are defined in EVENT_TYPES. Each has a corresponding class method that accepts user:, provider:, and request: (plus optional metadata:):

Event	Method	`user` nullable?	Call site
Successful login	`log_login!`	No	`sessions_controller.rb:238`
Failed login	`log_login_failed!`	Yes (always `nil`)	`sessions_controller.rb:309-313`
Local logout	`log_logout!`	No	`sessions_controller.rb:113`
Federated (IdP) logout	`log_logout_idp!`	No	`sessions_controller.rb:106`
Identity link	`log_link!`	No	`oidc_accounts_controller.rb:44-48`
Identity unlink	`log_unlink!`	No	(defined, not yet called)
JIT account created	`log_jit_account_created!`	No	`oidc_accounts_controller.rb:174-178`

log_login_failed! takes an additional required reason: argument, which is merged into metadata .

Where Events Fire#

Login / logout — both local and federated paths flow through SessionsController. On sign-out, sessions#destroy checks for session[:id_token_hint] and session[:sso_login_provider]; if present, it calls log_logout_idp! after redirecting the user to the IdP's end_session_endpoint, otherwise log_logout! fires .

Identity linking — fires in OidcAccountsController#create_link after OidcIdentity.create_from_omniauth succeeds .

JIT account creation — fires in OidcAccountsController#create_user after the user and OidcIdentity records are created in a single transaction .

Querying#

Three built-in scopes :

SsoAuditLog.recent — newest first
SsoAuditLog.for_user(user) — all events for a given user
SsoAuditLog.by_event("login_failed") — filter by event type

The belongs_to :user, optional: true association means joining to User requires guarding against nil user_id (as is the case for login_failed events).

SSO Authentication Flow — covers the OIDC callback, OidcIdentity, and session creation
app/models/sso_audit_log.rb — model source
db/migrate/20260103170412_create_sso_audit_logs.rb — schema
app/controllers/sessions_controller.rb — login/logout call sites
app/controllers/oidc_accounts_controller.rb — link/JIT call sites