Monitoring Service Plans and Apps

This topic explains how to monitor Single Sign-On (SSO) for Pivotal Cloud Foundry (PCF) service plans and apps.


SSO uses the User Account and Authentication (UAA) service to log security events through Loggregator. UAA security events can be filtered to destinations through a syslog drain. To configure logs to monitor SSO plan events, app, and UAA client events you need to obtain the IDs for the corresponding plan or app.

To obtain the identity zone ID for SSO plans, do one of the procedures in Monitor SSO Plan Events.

To obtain the client ID for an app or UAA client, do the procedure in Monitor App Events.

For information about configuring logging in Pivotal Application Services (PAS), see Configuring Logging in PAS.

For information about UAA security events, see UAA Logging.

Monitor SSO Plan Events

All SSO service plans are given a unique identity zone ID. You can monitor all events for a plan by filtering UAA generated logs using the plan’s identity zone ID.

You can obtain a list of plans and their corresponding identity zone IDs by doing one of the following:


Before you can use the SSO API to monitor plan events, you must do the following:

  1. Create an admin client. See Create an Admin Client.
  2. Create a UAA identity zone admin client. See Create a UAA Identity Zone Admin Client.

Use the SSO API

To use the SSO API to obtain plan identity zone IDs, run the following command:

curl -X GET "https://sso-api.YOUR-SYSTEM-DOMAIN/v1/plans" \
-H "Authorization: Bearer YOUR-TOKEN"


For more information, see SSO Service Plan Automation API in the SSO API documentation.

Use the SSO Operator Dashboard

To use the SSO Operator Dashboard to obtain plan identity zone IDs, do the following:

  1. Log into the SSO Operator Dashboard at https://p-identity.YOUR-SYSTEM-DOMAIN/dashboard
  2. Click the plan you want to obtain the identity zone ID for and select Edit Plan.
  3. Record the identity zone ID for your plan from the SSO Operator Dashboard URL. The URL looks similar to the following:


    Where IDENTITY-ZONE-ID is your plan’s identity zone ID.

Monitor App Events

All apps that use SSO have a unique client ID. You can monitor app and UAA client events using the client ID.

To find your app’s client ID, do the following:

  1. Log in to Apps Manager as a Space Developer.
  2. Select the space where your service instance is located.
  3. Under Services, click the Single Sign-On service.
  4. Click Manage next to your SSO service instance to launch the SSO Developer Dashboard.
  5. Under Applications, click View Credentials near the name of your app.
  6. Record the value of App ID.

Sso dev creds View a larger version of this image.