Apakah endpoint login return 401?

Who tried to authenticate?
From where?
Using which factor?
Against which tenant/client?
Was the credential valid?
Was the account locked?
Was MFA required?
Was MFA passed?
Was the session created?
Was a token issued?
Which token family?
Was the refresh token reused?
Was the request blocked by rate limit?
Was this part of a larger attack pattern?
Which users are affected?
Can we prove what happened?

Authentication control without observability is not controllable.

1. Structured event
   Fakta diskrit tentang kejadian authentication.

2. Metrics
   Agregasi kuantitatif untuk trend, alert, SLO, dan anomaly.

3. Traces
   Alur lintas service untuk request authentication/token/session.

4. Audit evidence
   Rekaman yang tahan review: siapa melakukan apa, kapan, terhadap boundary apa, dengan outcome apa.

A security-relevant authentication transition must emit a structured event.

1. What happened?
2. When did it happen?
3. Who was attempting the action?
4. Which account/subject was affected?
5. Which tenant/client/application boundary?
6. Which authentication method/factor?
7. What was the outcome?
8. Why did the system decide that outcome?
9. How can we correlate this to request/session/token/trace?

event_id
occurred_at
event_type
severity
outcome
reason_code
request_id
trace_id
correlation_id
tenant_id
client_id
actor_subject_id
target_account_id
credential_id / authenticator_id / session_id_hash / token_family_id
authentication_method
assurance_level
source_ip_hash or source_ip_prefix
user_agent_hash
device_id_hash
risk_score
risk_reasons

password
password reset token
one-time password
TOTP secret
raw recovery code
raw session id
raw access token
raw refresh token
raw API key
HMAC shared secret
private key
authorization code
code_verifier
full client secret
full email if policy privacy melarang
full phone number
full precise geolocation jika tidak perlu

subject_id internal
account_id internal
tenant_id
client_id
key prefix
credential id
factor id
session id hash
token jti hash
token family id
IP prefix or risk-normalized location
user agent hash
reason code

log.info("login failed username={} password={}", username, password);

log.info("auth.login.failed account_lookup={} tenant={} reason={} request_id={}",
    lookupResult.category(), tenantId, reasonCode, requestId);

auth.<object>.<verb>

auth.login.succeeded
auth.login.failed
auth.session.created
auth.session.revoked
auth.token.refreshed
auth.refresh.reuse_detected
auth.mfa.challenge.failed
auth.api_key.rotated
auth.rate_limit.exceeded

User logged in successfully from browser
Oops login failed
Bad token

Invalid credentials.

PASSWORD_MISMATCH
ACCOUNT_NOT_FOUND_SYNTHETIC_PATH
ACCOUNT_LOCKED
ACCOUNT_DISABLED
TENANT_NOT_FOUND
TENANT_MEMBERSHIP_MISSING
MFA_REQUIRED
MFA_CODE_INVALID
MFA_FACTOR_LOCKED
RATE_LIMITED_BY_ACCOUNT
RATE_LIMITED_BY_IP_PREFIX
TOKEN_EXPIRED
TOKEN_AUDIENCE_INVALID
TOKEN_ISSUER_INVALID
TOKEN_SIGNATURE_INVALID
REFRESH_TOKEN_REUSE_DETECTED
SESSION_NOT_FOUND
SESSION_REVOKED
API_KEY_HASH_NOT_FOUND
HMAC_NONCE_REPLAYED
CLIENT_CERT_UNTRUSTED

Generic outward response, specific internal reason code.

package com.acme.auth.observability;

import java.time.Instant;
import java.util.List;
import java.util.Map;
import java.util.UUID;

public record AuthEvent(
    UUID eventId,
    Instant occurredAt,
    String eventType,
    AuthSeverity severity,
    AuthOutcome outcome,
    String reasonCode,

    String tenantId,
    String clientId,
    String actorSubjectId,
    String targetAccountId,

    String requestId,
    String correlationId,
    String traceId,

    String authenticationMethod,
    String assuranceLevel,
    String sessionIdHash,
    String tokenFamilyId,
    String credentialId,
    String authenticatorId,

    String sourceIpHash,
    String sourceIpPrefix,
    String userAgentHash,
    String deviceIdHash,

    Integer riskScore,
    List<String> riskReasons,
    Map<String, String> attributes
) {}

public enum AuthSeverity {
    INFO,
    NOTICE,
    WARN,
    ERROR,
    CRITICAL
}

public enum AuthOutcome {
    SUCCESS,
    FAILURE,
    DENIED,
    CHALLENGE_REQUIRED,
    REVOKED,
    EXPIRED,
    DETECTED
}

public interface AuthEventPublisher {
    void publish(AuthEvent event);
}

LoginService -> AuthEventPublisher -> Log/Kafka/DB/SIEM

LoginService -> log + kafka + db + metrics + SIEM SDK

public final class JsonAuthEventPublisher implements AuthEventPublisher {
    private static final Logger log = LoggerFactory.getLogger("security.auth");
    private final ObjectMapper objectMapper;

    public JsonAuthEventPublisher(ObjectMapper objectMapper) {
        this.objectMapper = objectMapper;
    }

    @Override
    public void publish(AuthEvent event) {
        try {
            log.info(objectMapper.writeValueAsString(event));
        } catch (JsonProcessingException e) {
            log.error("auth_event_serialization_failed event_type={} event_id={}",
                event.eventType(), event.eventId(), e);
        }
    }
}

{
  "eventId": "68f52767-9b29-490d-9a0e-02a41c0e2f6b",
  "occurredAt": "2026-07-03T12:00:00Z",
  "eventType": "auth.login.failed",
  "severity": "WARN",
  "outcome": "FAILURE",
  "reasonCode": "PASSWORD_MISMATCH",
  "tenantId": "tenant_123",
  "clientId": "portal-web",
  "targetAccountId": "acct_987",
  "requestId": "req_abc",
  "correlationId": "corr_xyz",
  "authenticationMethod": "PASSWORD",
  "sourceIpPrefix": "203.0.113.0/24",
  "userAgentHash": "ua_3e5b...",
  "riskScore": 42,
  "riskReasons": ["FAILED_PASSWORD", "NEW_DEVICE"]
}

Never log raw session/token identifiers; log stable hashes or internal IDs.

public interface SensitiveIdentifierHasher {
    String hashForTelemetry(String rawValue);
}

public final class HmacSha256TelemetryHasher implements SensitiveIdentifierHasher {
    private final SecretKey key;

    public HmacSha256TelemetryHasher(SecretKey key) {
        this.key = key;
    }

    @Override
    public String hashForTelemetry(String rawValue) {
        try {
            Mac mac = Mac.getInstance("HmacSHA256");
            mac.init(key);
            byte[] digest = mac.doFinal(rawValue.getBytes(StandardCharsets.UTF_8));
            return Base64.getUrlEncoder().withoutPadding().encodeToString(digest);
        } catch (GeneralSecurityException e) {
            throw new IllegalStateException("telemetry hash failed", e);
        }
    }
}

public final class RequestCorrelationFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(
        HttpServletRequest request,
        HttpServletResponse response,
        FilterChain filterChain
    ) throws ServletException, IOException {
        String requestId = Optional.ofNullable(request.getHeader("X-Request-Id"))
            .filter(this::isSafeRequestId)
            .orElseGet(() -> UUID.randomUUID().toString());

        try {
            MDC.put("request_id", requestId);
            MDC.put("path", request.getRequestURI());
            filterChain.doFilter(request, response);
        } finally {
            MDC.clear();
        }
    }

    private boolean isSafeRequestId(String value) {
        return value.length() <= 128 && value.matches("[A-Za-z0-9._:-]+.");
    }
}

private boolean isSafeRequestId(String value) {
    return value != null
        && value.length() <= 128
        && value.matches("[A-Za-z0-9._:-]+");
}

MDC is for correlation, not for secrets.

@Component
public final class SpringAuthenticationEventListener {
    private final AuthEventPublisher publisher;
    private final RequestContextExtractor requestContextExtractor;

    public SpringAuthenticationEventListener(
        AuthEventPublisher publisher,
        RequestContextExtractor requestContextExtractor
    ) {
        this.publisher = publisher;
        this.requestContextExtractor = requestContextExtractor;
    }

    @EventListener
    public void onSuccess(AuthenticationSuccessEvent event) {
        RequestContext ctx = requestContextExtractor.current();
        Authentication authentication = event.getAuthentication();

        publisher.publish(AuthEventBuilder.base("auth.login.succeeded")
            .severity(AuthSeverity.INFO)
            .outcome(AuthOutcome.SUCCESS)
            .reasonCode("AUTHENTICATION_SUCCEEDED")
            .tenantId(ctx.tenantId())
            .clientId(ctx.clientId())
            .actorSubjectId(resolveSubject(authentication))
            .requestId(ctx.requestId())
            .traceId(ctx.traceId())
            .authenticationMethod(resolveMethod(authentication))
            .sourceIpPrefix(ctx.sourceIpPrefix())
            .userAgentHash(ctx.userAgentHash())
            .build());
    }

    @EventListener
    public void onFailure(AbstractAuthenticationFailureEvent event) {
        RequestContext ctx = requestContextExtractor.current();

        publisher.publish(AuthEventBuilder.base("auth.login.failed")
            .severity(AuthSeverity.WARN)
            .outcome(AuthOutcome.FAILURE)
            .reasonCode(mapFailure(event.getException()))
            .tenantId(ctx.tenantId())
            .clientId(ctx.clientId())
            .requestId(ctx.requestId())
            .traceId(ctx.traceId())
            .sourceIpPrefix(ctx.sourceIpPrefix())
            .userAgentHash(ctx.userAgentHash())
            .build());
    }

    private String mapFailure(AuthenticationException exception) {
        if (exception instanceof BadCredentialsException) return "BAD_CREDENTIALS";
        if (exception instanceof LockedException) return "ACCOUNT_LOCKED";
        if (exception instanceof DisabledException) return "ACCOUNT_DISABLED";
        if (exception instanceof CredentialsExpiredException) return "CREDENTIAL_EXPIRED";
        return "AUTHENTICATION_FAILED";
    }
}

public final class BearerTokenObservationFilter extends OncePerRequestFilter {
    private final AuthEventPublisher publisher;
    private final SensitiveIdentifierHasher hasher;

    public BearerTokenObservationFilter(
        AuthEventPublisher publisher,
        SensitiveIdentifierHasher hasher
    ) {
        this.publisher = publisher;
        this.hasher = hasher;
    }

    @Override
    protected void doFilterInternal(
        HttpServletRequest request,
        HttpServletResponse response,
        FilterChain chain
    ) throws ServletException, IOException {
        try {
            chain.doFilter(request, response);
        } finally {
            Authentication authentication = SecurityContextHolder.getContext().getAuthentication();

            if (authentication instanceof JwtAuthenticationToken jwtAuth) {
                Jwt jwt = jwtAuth.getToken();

                publisher.publish(AuthEventBuilder.base("auth.token.accepted")
                    .severity(AuthSeverity.INFO)
                    .outcome(AuthOutcome.SUCCESS)
                    .tenantId(extractTenant(jwt))
                    .clientId(jwt.getClaimAsString("azp"))
                    .actorSubjectId(jwt.getSubject())
                    .reasonCode("JWT_ACCEPTED")
                    .attributes(Map.of(
                        "issuer", jwt.getIssuer().toString(),
                        "audience", String.join(",", jwt.getAudience()),
                        "jti_hash", hasher.hashForTelemetry(jwt.getId())
                    ))
                    .build());
            }
        }
    }
}

Emit detailed event for state-changing auth transitions.
Emit metrics/sampled traces for high-volume repeated validation.

@Provider
@Priority(Priorities.AUTHENTICATION)
public final class JwtAuthenticationFilter implements ContainerRequestFilter {
    private final JwtVerifier verifier;
    private final AuthEventPublisher events;

    public JwtAuthenticationFilter(JwtVerifier verifier, AuthEventPublisher events) {
        this.verifier = verifier;
        this.events = events;
    }

    @Override
    public void filter(ContainerRequestContext requestContext) {
        RequestContext ctx = RequestContext.from(requestContext);
        String bearer = extractBearer(requestContext);

        if (bearer == null) {
            events.publish(AuthEventBuilder.base("auth.token.missing")
                .severity(AuthSeverity.INFO)
                .outcome(AuthOutcome.DENIED)
                .reasonCode("BEARER_TOKEN_MISSING")
                .requestId(ctx.requestId())
                .build());
            abortUnauthorized(requestContext);
            return;
        }

        try {
            VerifiedJwt jwt = verifier.verify(bearer);
            requestContext.setSecurityContext(new JwtSecurityContext(jwt));
        } catch (JwtVerificationException ex) {
            events.publish(AuthEventBuilder.base("auth.token.rejected")
                .severity(AuthSeverity.WARN)
                .outcome(AuthOutcome.DENIED)
                .reasonCode(ex.reasonCode())
                .requestId(ctx.requestId())
                .tenantId(ctx.tenantId())
                .build());
            abortUnauthorized(requestContext);
        }
    }
}

auth_login_attempt_total{outcome, method, tenant_tier}
auth_login_failure_total{reason_code, method}
auth_rate_limited_total{dimension}
auth_mfa_challenge_total{factor_type, outcome}
auth_token_refresh_total{outcome}
auth_refresh_reuse_detected_total
auth_session_active_count{tenant_tier}
auth_password_hash_duration_seconds{algorithm}
auth_jwt_validation_duration_seconds{issuer}
auth_idp_callback_duration_seconds{provider}

user_id
email
session_id
ip_address
raw_client_id jika jumlahnya sangat besar dan tidak terkendali

public final class AuthMetrics {
    private final MeterRegistry registry;

    public AuthMetrics(MeterRegistry registry) {
        this.registry = registry;
    }

    public void recordLoginAttempt(String method, String outcome, String reasonCode) {
        Counter.builder("auth.login.attempt")
            .tag("method", safe(method))
            .tag("outcome", safe(outcome))
            .tag("reason", safeReason(reasonCode))
            .register(registry)
            .increment();
    }

    public <T> T timePasswordHash(String algorithm, Supplier<T> action) {
        return Timer.builder("auth.password.hash.duration")
            .tag("algorithm", safe(algorithm))
            .publishPercentileHistogram()
            .register(registry)
            .record(action);
    }
}

Metrics labels must be low-cardinality and non-secret.

login attempts per minute
success rate
failure rate by reason
p95/p99 login latency
password hash duration
account lookup latency
session creation latency

rate-limited requests
top failure reason trend
password spray indicator
credential stuffing indicator
MFA failure spike
refresh token reuse detection
API key failure spike
HMAC nonce replay spike

active sessions
session revocation rate
refresh token rotation failure
expired token rejection
audience mismatch rejection
issuer mismatch rejection
JWKS refresh failures

OIDC callback failures
state mismatch
nonce mismatch
IdP latency
JIT provisioning failure
SAML assertion validation failure

login success/failure by tenant tier
tenant resolution failures
cross-tenant token rejection
membership missing failures

Many distinct account identifiers
from same IP prefix/device/user agent family
with password mismatch
within short window

SELECT source_ip_prefix, COUNT(DISTINCT target_account_id) AS accounts, COUNT(*) AS failures
FROM auth_events
WHERE event_type = 'auth.login.failed'
  AND reason_code IN ('PASSWORD_MISMATCH', 'BAD_CREDENTIALS')
  AND occurred_at > now() - interval '10 minutes'
GROUP BY source_ip_prefix
HAVING COUNT(DISTINCT target_account_id) > 50
   AND COUNT(*) > 200;

Same password campaign cannot be logged directly,
but pattern is many accounts, low frequency each,
same IP/device/user agent, generic bad credentials.

Successful login from new device
after many failed attempts
followed by password/MFA/recovery changes.

refresh token reuse detected
or same token family used from incompatible device/location.

many push challenges
few approvals
then sudden success
from suspicious source.

token issuer valid
but tenant route mismatch or membership missing.

CREATE TABLE auth_audit_event (
    event_id UUID PRIMARY KEY,
    occurred_at TIMESTAMPTZ NOT NULL,
    event_type TEXT NOT NULL,
    severity TEXT NOT NULL,
    outcome TEXT NOT NULL,
    reason_code TEXT NOT NULL,

    tenant_id TEXT,
    client_id TEXT,
    actor_subject_id TEXT,
    target_account_id TEXT,

    request_id TEXT,
    correlation_id TEXT,
    trace_id TEXT,

    authentication_method TEXT,
    assurance_level TEXT,
    session_id_hash TEXT,
    token_family_id TEXT,
    credential_id TEXT,
    authenticator_id TEXT,

    source_ip_hash TEXT,
    source_ip_prefix TEXT,
    user_agent_hash TEXT,
    device_id_hash TEXT,

    risk_score INTEGER,
    risk_reasons JSONB NOT NULL DEFAULT '[]'::jsonb,
    attributes JSONB NOT NULL DEFAULT '{}'::jsonb
);

CREATE INDEX idx_auth_audit_event_time
    ON auth_audit_event (occurred_at DESC);

CREATE INDEX idx_auth_audit_event_account_time
    ON auth_audit_event (target_account_id, occurred_at DESC);

CREATE INDEX idx_auth_audit_event_tenant_time
    ON auth_audit_event (tenant_id, occurred_at DESC);

CREATE INDEX idx_auth_audit_event_type_time
    ON auth_audit_event (event_type, occurred_at DESC);

CREATE INDEX idx_auth_audit_event_reason_time
    ON auth_audit_event (reason_code, occurred_at DESC);

CREATE TABLE auth_audit_event_2026_07
    PARTITION OF auth_audit_event
    FOR VALUES FROM ('2026-07-01') TO ('2026-08-01');

Should authentication fail if audit event cannot be written?

State change transaction -> audit outbox row -> async publisher -> SIEM/log sink

CREATE TABLE auth_audit_outbox (
    outbox_id UUID PRIMARY KEY,
    event_id UUID NOT NULL,
    occurred_at TIMESTAMPTZ NOT NULL,
    event_type TEXT NOT NULL,
    payload JSONB NOT NULL,
    published_at TIMESTAMPTZ,
    publish_attempts INTEGER NOT NULL DEFAULT 0,
    next_attempt_at TIMESTAMPTZ NOT NULL DEFAULT now()
);

Collect enough to secure and audit.
Do not collect because it is interesting.

private static final Set<String> LOGGABLE_CLAIMS = Set.of(
    "iss", "aud", "azp", "typ", "jti", "tenant_id", "auth_time", "acr", "amr"
);

log.info("jwt claims={}", jwt.getClaims());

POST /login
  auth.resolve_tenant
  auth.rate_limit.check
  auth.account.lookup
  auth.password.verify
  auth.mfa.evaluate
  auth.session.create
  auth.audit.publish

auth.method=password
auth.outcome=failure
auth.reason_code=PASSWORD_MISMATCH
auth.tenant_tier=enterprise
auth.client_type=web
auth.assurance_level=aal2

auth.password=...
auth.token=...
auth.email=...
auth.session_id=...

Span span = tracer.spanBuilder("auth.password.verify").startSpan();
try (Scope ignored = span.makeCurrent()) {
    span.setAttribute("auth.method", "password");
    span.setAttribute("auth.algorithm", passwordHash.algorithm());
    boolean matched = passwordVerifier.verify(rawPassword, passwordHash);
    span.setAttribute("auth.outcome", matched ? "success" : "failure");
    return matched;
} catch (RuntimeException ex) {
    span.recordException(ex);
    span.setStatus(StatusCode.ERROR);
    throw ex;
} finally {
    span.end();
}

Login failed.

Refresh token reuse detected for token family with active sessions.
Action: revoke token family, mark account risk, require re-auth.

what happened
affected tenant/client/account count
time window
reason codes
sample correlation ids
suggested runbook

-- Which sessions did this account create recently?
SELECT occurred_at, session_id_hash, source_ip_prefix, user_agent_hash, risk_score
FROM auth_audit_event
WHERE target_account_id = 'acct_123'
  AND event_type = 'auth.session.created'
  AND occurred_at > now() - interval '7 days'
ORDER BY occurred_at DESC;

-- Was refresh token reuse detected?
SELECT *
FROM auth_audit_event
WHERE token_family_id = 'rtf_abc'
  AND event_type = 'auth.refresh.reuse_detected';

-- Which accounts were targeted by same IP prefix?
SELECT target_account_id, count(*)
FROM auth_audit_event
WHERE source_ip_prefix = '203.0.113.0/24'
  AND event_type = 'auth.login.failed'
  AND occurred_at > now() - interval '1 hour'
GROUP BY target_account_id
ORDER BY count(*) DESC;

-- Which admin changed MFA factors?
SELECT occurred_at, actor_subject_id, target_account_id, reason_code, attributes
FROM auth_audit_event
WHERE event_type IN ('auth.mfa.factor.removed', 'auth.admin.factor_reset')
  AND occurred_at > now() - interval '30 days';

[ ] Does every auth state transition emit a structured event?
[ ] Are outward messages generic but internal reason codes specific?
[ ] Are raw credentials/tokens/session ids never logged?
[ ] Are token claims allowlisted before logging?
[ ] Are event names stable and documented?
[ ] Are event IDs and timestamps generated server-side?
[ ] Are request_id, trace_id, tenant_id, client_id included where applicable?
[ ] Are metrics labels low-cardinality?
[ ] Are high-value audit events stored durably?
[ ] Does audit use outbox or reliable publication?
[ ] Are retention policies defined by event type?
[ ] Are events useful for incident response queries?
[ ] Are rate-limit, lockout, MFA, reset, token, and admin actions observable?
[ ] Are MDC and ThreadLocal values cleared after request?
[ ] Are alert rules actionable and tied to runbooks?

10,000 login failures in 10 minutes
8,000 distinct account identifiers
50 IP prefixes
few success events

Design detection query.
Choose automated throttle dimensions.
Decide whether to lock accounts.
Explain why account lockout may help attacker.

Throttle source/IP/device/client dimensions first.
Avoid mass account lockout.
Raise risk score.
Require step-up for suspicious successful login.

refresh token family rtf_123 reused from new device
legitimate user still active

Which events are emitted?
Which sessions/tokens are revoked?
Which alert fires?
What user-facing action is required?

auth.refresh.reuse_detected
auth.token.family_revoked
auth.session.revoked
force reauthentication and possibly step-up

SIEM endpoint down for 1 hour
login traffic normal
password changes continue

Which events can be buffered?
Which events must be durable in DB?
What dashboard shows backlog?
When should auth degrade or fail closed?

This subject attempted this authentication method,
against this tenant and client,
from this risk context,
with this outcome and reason,
causing this session/token/factor transition,
correlated to this request/trace,
recorded without leaking secrets.