Skip to main content

KeycloakEventRequest: retrieve login and admin access events

TL;DR

Query Keycloak access events in Atlan by date range and event type (LOGIN, LOGOUT, and others) using KeycloakEventRequest and the Python SDK.

Connect

Use KeycloakEventRequest in the Atlan Python SDK to programmatically retrieve login and admin access events.

All events​

You can retrieve and filter all access-related events using:

Filter all events
client // (1)
    .logs // (2)
    .getEvents(KeycloakEventRequest.builder() // (3)
        .dateFrom("2023-01-01") // (4)
        .dateTo("2023-01-31") // (5)
        .type(KeycloakEventType.LOGIN) // (6)
        .type(KeycloakEventType.LOGOUT)
        .build())
    .stream() // (7)
    .limit(1000) // (8)
    .forEach(event -> { // (9)
        // Do something with each event
    });
  1. From a client...
  2. ... access the logs endpoints.
  3. The getEvents() method allows you to filter across all access events that are logged.
  4. (Optional) You can filter by events only back to a particular point in time (using the format yyyy-MM-dd).
  5. (Optional) You can filter by events only up to a particular point in time (using the format yyyy-MM-dd).
  6. (Optional) You can filter by one or more types of events, for example focusing only on logins and logouts.
  7. Like other paginated resources, you can iterate or stream the results. The access events will be lazily-fetched from Atlan.
  8. When streaming, you can apply any additional constraints such as limiting or further filtering.
  9. And of course, you can then actually do something with each event.

Admin events​

You can retrieve and filter administrative events using:

Filter admin events
client // (1)
    .logs // (2)
    .getAdminEvents(AdminEventRequest.builder() // (3)
        .dateFrom("2023-01-01") // (4)
        .dateTo("2023-01-31") // (5)
        .operationType(AdminOperationType.CREATE) // (6)
        .operationType(AdminOperationType.UPDATE)
        .resourceType(AdminResourceType.REALM_ROLE) // (7)
        .resourceType(AdminResourceType.REALM_ROLE_MAPPING)
        .resourcePath("roles/connection_admins_e71551e0-7f59-44bb-989c-e434f2e5bcae") // (8)
        .build())
    .stream() // (9)
    .limit(1000) // (10)
    .forEach(event -> { // (11)
        // Do something with each event
    });
  1. From a client...
  2. ... access the logs endpoints.
  3. The getAdminEvents() method allows you to filter across all admin events that are logged.
  4. (Optional) You can filter by events only back to a particular point in time (using the format yyyy-MM-dd).
  5. (Optional) You can filter by events only up to a particular point in time (using the format yyyy-MM-dd).
  6. (Optional) You can filter by one or more operations, for example focusing only on creation and updates.
  7. (Optional) You can filter by one or more resource types, for example only new roles or mappings to roles.
  8. (Optional) You can filter by a specific resource, such as the role associated with all admins for a specific connection in Atlan.
  9. Like other paginated resources, you can iterate or stream the results. The access events will be lazily-fetched from Atlan.
  10. When streaming, you can apply any additional constraints such as limiting or further filtering.
  11. And of course, you can then actually do something with each event.
Was this page helpful?