Troubleshoot Sso Saml Attribute Mapping Sts Audit Logs

What the Security Token Service Data Access Audit Logging Is

Security Token Service (STS) is the underlying Google Cloud service responsible for validating external identity provider tokens (such as SAML 2.0 assertions or OIDC identity tokens) and exchanging them for short-lived Google Cloud federated access tokens during Workforce Identity Federation flows. Enabling Data Access audit logs for the Security Token Service API (sts.googleapis.com) allows administrators to capture and inspect the payload metadata, claim evaluation results, and attribute mapping operations in real time.

How It Meets the Troubleshooting Requirements

• Inspect assertion claims and mappings: When users authenticate, STS parses the SAML assertion against configured attribute mappings (for example, mapping google.subject to the incoming email claim and google.groups to group assertions). If an IdP schema change introduces an attribute claim mismatch, STS logs the failure details directly in Cloud Audit Logs.
• Diagnose token exchange failures: Cloud Audit Logs capture granular error details, such as missing mandatory attributes (google.subject), invalid assertion structures, or schema expression evaluation errors (such as failed lowerAscii() transformations).
• Centralized visibility: Logs Explorer provides searchable, structured JSON audit records containing the principal identifier, provider ID, workforce pool ID, and specific error codes.

Key Advantages and Capabilities

• Deep identity diagnostics: Provides non-repudiable audit trails of authentication attempts and federated token exchanges.
• Error pattern identification: Allows security teams to quickly distinguish between expired cryptographic signing certificates, incorrect SAML entity IDs, and missing assertion attributes.
• Seamless integration with Cloud Logging: Supports creating log-based metrics and alerts to proactively catch synchronization and login anomalies.

Why This Is Optimal

Using Data Access audit logs for the Security Token Service API directly pinpoints the exact point of failure within the federated token exchange pipeline without requiring client-side packet capture or invasive identity provider reconfigurations.