A.1.6 USER_DELETE

M-CNCC IAM UI- cncc Realm- User Deletion Event

Figure -7 Delete user

M-CNCC IAM Kc Logs

Note:

• userId field in the log depicts which ADMIN User is performing this USER_DELETE event.
• resourcePath in the logs depicts the UserId of the user which got deleted.

Event log:

{"timestamp":"2025-11-27T15:13:35.626159405Z","sequence":2630,"loggerClassName":"org.jboss.logging.Logger","loggerName":"org.keycloak.events","level":"DEBUG","message":"operationType=\"DELETE\", realmId=\"master\", realmName=\"master\", clientId=\"6d475927-19a8-4082-a9f4-8d6b68afbb1a\", userId=\"acc21615-964a-4055-8c20-fb2705bd641b\", ipAddress=\"10.75.213.184\", resourceType=\"USER\", resourcePath=\"users/ce2362ff-5fd7-4596-8846-e6a46be0819f\"","threadName":"executor-thread-96","threadId":172,"mdc":{},"ndc":"","hostName":"cncc-iam","processName":"/opt/java/jre/bin/java","processId":571}

M-CNCC IAM Ingress Gateway logs

SECURITY- Request log:

{
  "instant": {
    "epochSecond": 1764256415,
    "nanoOfSecond": 448295140
  },
  "thread": "igw-app-thread16",
  "level": "INFO",
  "loggerName": "ocpm.cne.gateway.cncc.filters.CnccLoggingFilter",
  "message": {
    "logType": "SECURITY",
    "type": "REQUEST",
    "operationType": "DELETE",
    "userId": "acc21615-964a-4055-8c20-fb2705bd641b",
    "username": "admin",
    "remoteAddress": "xx.xx.xx.xx:xxxxx",
    "localAddress": "xx.xx.xx.xx:xxxx",
    "resourcePath": "/cncc/auth/admin/realms/cncc/users/ce2362ff-5fd7-4596-8846-e6a46be0819f",
    "scheme": "http",
    "queryParams": {},
    "headers": {
      "Origin": "http://xx.xx.xx.xx:xxxxx",
      "Cookie": "{masked}",
      "Connection": "keep-alive",
      "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36",
      "uuidToken": "46afa106-6056-406f-b8bc-0d40d2b5ee71",
      "Host": "xx.xx.xx.xx:xxxxx",
      "Accept-Encoding": "gzip, deflate",
      "svcName": "cncc-iam-kc-http.cncc.svc.cluster.local",
      "ocLogId": "1764256415445_92_cncc-iam-ingress-gateway-85d6d57584-wt9zk",
      "accept": "application/json, text/plain, */*",
      "sbi-timer-publish-headers": "false",
      "authorization": "{masked}",
      "content-type": "application/json",
      "Accept-Language": "en-US,en;q=0.9",
      "Content-Length": "2",
      "sbi-timer-feature": "false"
    },
    "payload": {},
    "authenticationType": "UNKNOWN"
  },
  "endOfBatch": false,
  "loggerFqcn": "org.apache.logging.log4j.internal.DefaultLogBuilder",
  "threadId": 132,
  "threadPriority": 5,
  "messageTimestamp": "2025-11-27T15:13:35.448+0000",
  "processId": "1",
  "ingressTxId": "ingress-tx-970863000",
  "pod": "cncc-iam-ingress-gateway-85d6d57584-wt9zk",
  "ocLogId": "1764256415445_92_cncc-iam-ingress-gateway-85d6d57584-wt9zk",
  "instanceType": "prod",
  "xRequestId": "-"
}

SECURITY- Response log:

{
  "instant": {
    "epochSecond": 1764256415,
    "nanoOfSecond": 635694136
  },
  "thread": "igw-app-thread13",
  "level": "INFO",
  "loggerName": "ocpm.cne.gateway.cncc.filters.CnccLoggingFilter",
  "message": {
    "logType": "SECURITY",
    "type": "RESPONSE",
    "operationType": "DELETE",
    "userId": "acc21615-964a-4055-8c20-fb2705bd641b",
    "username": "admin",
    "resourcePath": "/cncc/auth/admin/realms/cncc/users/ce2362ff-5fd7-4596-8846-e6a46be0819f",
    "scheme": "http",
    "headers": {
      "Referrer-Policy": "no-referrer",
      "X-Frame-Options": "SAMEORIGIN",
      "Access-Control-Expose-Headers": "Location",
      "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
      "transfer-encoding": "chunked",
      "Cache-Control": "no-cache",
      "Access-Control-Allow-Origin": "http://xx.xx.xx.xx:xxxxx",
      "Access-Control-Allow-Credentials": "true",
      "X-Content-Type-Options": "nosniff",
      "RequestMethod": "DELETE",
      "NettyLatency": "1764256415445"
    },
    "payload": {},
    "authenticationType": "UNKNOWN",
    "status": "204 NO_CONTENT"
  },
  "endOfBatch": false,
  "loggerFqcn": "org.apache.logging.log4j.internal.DefaultLogBuilder",
  "threadId": 129,
  "threadPriority": 5,
  "messageTimestamp": "2025-11-27T15:13:35.635+0000",
  "processId": "1",
  "ingressTxId": "ingress-tx-2129472853",
  "pod": "cncc-iam-ingress-gateway-85d6d57584-wt9zk",
  "ocLogId": "-",
  "instanceType": "prod",
  "xRequestId": "-"
}

Note:

Similar logs will also be observed for the default realm.