A.1.4 USER_CREATE

M-CNCC IAM UI- cncc Realm- User Creation Event

Figure -5 User details

M-CNCC IAM Kc Logs:

Note:

• userId field in the log depicts which ADMIN User is performing this USER_CREATE event
• resourcePath in the logs depicts the UserId of the user which got created

Event log:

{"timestamp":"2025-11-27T15:05:18.927732842Z","sequence":2613,"loggerClassName":"org.jboss.logging.Logger","loggerName":"org.keycloak.events","level":"DEBUG","message":"operationType=\"CREATE\", realmId=\"master\", realmName=\"master\", clientId=\"6d475927-19a8-4082-a9f4-8d6b68afbb1a\", userId=\"acc21615-964a-4055-8c20-fb2705bd641b\", ipAddress=\"10.75.213.184\", resourceType=\"USER\", resourcePath=\"users/ce2362ff-5fd7-4596-8846-e6a46be0819f\"","threadName":"executor-thread-91","threadId":158,"mdc":{},"ndc":"","hostName":"cncc-iam","processName":"/opt/java/jre/bin/java","processId":571}

M-CNCC IAM Ingress Gateway logs:

SECURITY- Request log:

{
  "instant": {
    "epochSecond": 1764255918,
    "nanoOfSecond": 806555890
  },
  "thread": "igw-app-thread8",
  "level": "INFO",
  "loggerName": "ocpm.cne.gateway.cncc.filters.CnccLoggingFilter",
  "message": {
    "logType": "SECURITY",
    "type": "REQUEST",
    "operationType": "POST",
    "userId": "acc21615-964a-4055-8c20-fb2705bd641b",
    "username": "admin",
    "remoteAddress": "xx.xx.xx.xx:xxxxx",
    "localAddress": "xx.xx.xx.xx:xxxx",
    "resourcePath": "/cncc/auth/admin/realms/cncc/users",
    "scheme": "http",
    "queryParams": {},
    "headers": {
      "Origin": "http://xx.xx.xx.xx:xxxxx",
      "Cookie": "{masked}",
      "Connection": "keep-alive",
      "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36",
      "uuidToken": "9efc97ba-8d29-48c1-ac49-89ede18d6a4d",
      "Host": "xx.xx.xx.xx:xxxxx",
      "Accept-Encoding": "gzip, deflate",
      "svcName": "cncc-iam-kc-http.cncc.svc.cluster.local",
      "ocLogId": "1764255918804_97_cncc-iam-ingress-gateway-85d6d57584-wt9zk",
      "accept": "application/json, text/plain, */*",
      "sbi-timer-publish-headers": "false",
      "authorization": "{masked}",
      "content-type": "application/json",
      "Accept-Language": "en-US,en;q=0.9",
      "Content-Length": "151",
      "sbi-timer-feature": "false"
    },
    "payload": {
      "requiredActions": [],
      "emailVerified": false,
      "username": "user_test2",
      "email": "",
      "firstName": "",
      "lastName": "",
      "groups": [],
      "attributes": {},
      "enabled": true
    },
    "authenticationType": "UNKNOWN"
  },
  "endOfBatch": false,
  "loggerFqcn": "org.apache.logging.log4j.internal.DefaultLogBuilder",
  "threadId": 116,
  "threadPriority": 5,
  "messageTimestamp": "2025-11-27T15:05:18.806+0000",
  "processId": "1",
  "ingressTxId": "ingress-tx-615688795",
  "pod": "cncc-iam-ingress-gateway-85d6d57584-wt9zk",
  "ocLogId": "1764255918804_97_cncc-iam-ingress-gateway-85d6d57584-wt9zk",
  "instanceType": "prod",
  "xRequestId": "-"
}

SECURITY- Response log:

{
  "instant": {
    "epochSecond": 1764255918,
    "nanoOfSecond": 933502119
  },
  "thread": "igw-app-thread17",
  "level": "INFO",
  "loggerName": "ocpm.cne.gateway.cncc.filters.CnccLoggingFilter",
  "message": {
    "logType": "SECURITY",
    "type": "RESPONSE",
    "operationType": "POST",
    "userId": "acc21615-964a-4055-8c20-fb2705bd641b",
    "username": "admin",
    "resourcePath": "/cncc/auth/admin/realms/cncc/users",
    "scheme": "http",
    "headers": {
      "content-length": "0",
      "transfer-encoding": "chunked",
      "Access-Control-Allow-Origin": "http://xx.xx.xx.xx:xxxxx",
      "X-Content-Type-Options": "nosniff",
      "RequestMethod": "POST",
      "Referrer-Policy": "no-referrer",
      "X-Frame-Options": "SAMEORIGIN",
      "Access-Control-Expose-Headers": "Location",
      "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
      "Access-Control-Allow-Credentials": "true",
      "NettyLatency": "1764255918804",
      "Location": "http://xx.xx.xx.xx:xxxxx/cncc/auth/admin/realms/cncc/users/ce2362ff-5fd7-4596-8846-e6a46be0819f"
    },
    "payload": {},
    "authenticationType": "UNKNOWN",
    "status": "201 CREATED"
  },
  "endOfBatch": false,
  "loggerFqcn": "org.apache.logging.log4j.internal.DefaultLogBuilder",
  "threadId": 133,
  "threadPriority": 5,
  "messageTimestamp": "2025-11-27T15:05:18.933+0000",
  "processId": "1",
  "ingressTxId": "ingress-tx-43404993",
  "pod": "cncc-iam-ingress-gateway-85d6d57584-wt9zk",
  "ocLogId": "-",
  "instanceType": "prod",
  "xRequestId": "-"
}

Note:

Similar logs will also be observed for the default realm.