Collect ForgeRock OpenIDM logs

This document explains how to ingest ForgeRock OpenIDM logs to Google Security Operations using Google Cloud Storage V2.

ForgeRock OpenIDM (now branded as PingIDM) is an identity management platform that provides user provisioning, synchronization, password management, and access governance. It logs identity lifecycle events, authentication attempts, reconciliation operations, and configuration changes to audit logs accessible over REST.

Before you begin

Ensure that you have the following prerequisites:

• A Google SecOps instance
• A GCP project with Cloud Storage API enabled
• Permissions to create and manage GCS buckets
• Permissions to manage IAM policies on GCS buckets
• Permissions to create Cloud Run services, Pub/Sub topics, and Cloud Scheduler jobs
• Privileged access to ForgeRock OpenIDM or PingIDM instance with administrative credentials

Create Google Cloud Storage bucket

1. Go to the Google Cloud Console .
2. Select your project or create a new one.
3. In the navigation menu, go to Cloud Storage > Buckets.
4. Click Create bucket.

5. Provide the following configuration details:

   Setting	Value
   Name your bucket	Enter a globally unique name (for example, forgerock-openidm-audit-logs )
   Location type	Choose based on your needs (Region, Dual-region, Multi-region)
   Location	Select the location (for example, us-central1 )
   Storage class	Standard (recommended for frequently accessed logs)
   Access control	Uniform (recommended)
   Protection tools	Optional: Enable object versioning or retention policy

6. Click Create.

Collect ForgeRock OpenIDM credentials

Get ForgeRock OpenIDM base URL

1. Sign in to your ForgeRock OpenIDM or PingIDM instance.
2. Note your base URL from the browser address bar.
   • Format: https://openidm.example.com
   • Do not include trailing slashes or paths like /admin

Get administrative credentials

1. Obtain administrative credentials for your ForgeRock OpenIDM instance.

2. You will need:

   • Username: Administrative username (for example, openidm-admin )
   • Password: Administrative password

Verify permissions

To verify the account has the required permissions:

1. Sign in to ForgeRock OpenIDM.
2. Go to Configure > System Preferences > Audit.
3. If you can see audit configuration and topics, you have the required permissions.
4. If you cannot see this option, contact your administrator to grant audit read permissions.

Test API access

Test your credentials before proceeding with the integration:

  # Replace with your actual credentials 
 OPENIDM_BASE_URL 
 = 
 "https://openidm.example.com" 
 OPENIDM_USERNAME 
 = 
 "openidm-admin" 
 OPENIDM_PASSWORD 
 = 
 "your-admin-password" 
 # Test API access to authentication audit topic 
curl  
-v  
 \ 
  
-H  
 "X-OpenIDM-Username: 
 ${ 
 OPENIDM_USERNAME 
 } 
 " 
  
 \ 
  
-H  
 "X-OpenIDM-Password: 
 ${ 
 OPENIDM_PASSWORD 
 } 
 " 
  
 \ 
  
-H  
 "Accept-API-Version: resource=1.0" 
  
 \ 
  
-H  
 "Accept: application/json" 
  
 \ 
  
 " 
 ${ 
 OPENIDM_BASE_URL 
 } 
 /openidm/audit/authentication?_queryFilter=true&_pageSize=1" 
 

Expected response: HTTP 200 with JSON containing audit events.

Create service account for Cloud Run function

The Cloud Run function needs a service account with permissions to write to GCS bucket and be invoked by Pub/Sub.

Create service account

1. In the GCP Console, go to IAM & Admin > Service Accounts.
2. Click Create Service Account.
3. Provide the following configuration details:
   • Service account name: Enter forgerock-openidm-collector-sa .
   • Service account description: Enter Service account for Cloud Run function to collect ForgeRock OpenIDM logs .
4. Click Create and Continue.
5. In the Grant this service account access to projectsection, add the following roles:
   1. Click Select a role.
   2. Search for and select Storage Object Admin.
   3. Click + Add another role.
   4. Search for and select Cloud Run Invoker.
   5. Click + Add another role.
   6. Search for and select Cloud Functions Invoker.
6. Click Continue.
7. Click Done.

These roles are required for:

• Storage Object Admin: Write logs to GCS bucket and manage state files
• Cloud Run Invoker: Allow Pub/Sub to invoke the function
• Cloud Functions Invoker: Allow function invocation

Grant IAM permissions on GCS bucket

Grant the service account write permissions on the GCS bucket:

1. Go to Cloud Storage > Buckets.
2. Click your bucket name (for example, forgerock-openidm-audit-logs ).
3. Go to the Permissionstab.
4. Click Grant access.
5. Provide the following configuration details:
   • Add principals: Enter the service account email (for example, forgerock-openidm-collector-sa@PROJECT_ID.iam.gserviceaccount.com ).
   • Assign roles: Select Storage Object Admin.
6. Click Save.

Create Pub/Sub topic

Create a Pub/Sub topic that Cloud Scheduler will publish to and the Cloud Run function will subscribe to.

1. In the GCP Console, go to Pub/Sub > Topics.
2. Click Create topic.
3. Provide the following configuration details:
   • Topic ID: Enter forgerock-openidm-trigger .
   • Leave other settings as default.
4. Click Create.

Create Cloud Run function to collect logs

The Cloud Run function will be triggered by Pub/Sub messages from Cloud Scheduler to fetch logs from ForgeRock OpenIDM API and write them to GCS.

1. In the GCP Console, go to Cloud Run.
2. Click Create service.
3. Select Function(use an inline editor to create a function).

4. In the Configuresection, provide the following configuration details:

   Setting	Value
   Service name	forgerock-openidm-collector
   Region	Select region matching your GCS bucket (for example, us-central1 )
   Runtime	Select Python 3.12or later

5. In the Trigger (optional)section:

   1. Click + Add trigger.
   2. Select Cloud Pub/Sub.
   3. In Select a Cloud Pub/Sub topic, choose the Pub/Sub topic forgerock-openidm-trigger .
   4. Click Save.

6. In the Authenticationsection:

   1. Select Require authentication.
   2. Check Identity and Access Management (IAM).

7. Scroll to and expand Containers, Networking, Security.

8. Go to the Securitytab:

   • Service account: Select the service account forgerock-openidm-collector-sa .

9. Go to the Containerstab:

   1. Click Variables & Secrets.

   2. Click + Add variablefor each environment variable:

      Variable Name	Example Value	Description
      GCS_BUCKET	forgerock-openidm-audit-logs	GCS bucket name
      GCS_PREFIX	openidm	Prefix for log files
      STATE_KEY	openidm/state.json	State file path
      OPENIDM_BASE_URL	https://openidm.example.com	OpenIDM base URL
      OPENIDM_USERNAME	openidm-admin	OpenIDM admin username
      OPENIDM_PASSWORD	your-admin-password	OpenIDM admin password
      AUDIT_TOPICS	access,activity,authentication,config,sync	Comma-separated audit topics
      PAGE_SIZE	100	Records per page
      MAX_PAGES	50	Maximum pages per topic

10. In the Variables & Secretssection, scroll down to Requests:

    • Request timeout: Enter 600 seconds (10 minutes).

11. Go to the Settingstab:

    • In the Resourcessection:
      • Memory: Select 512 MiBor higher.
      • CPU: Select 1.
    • In the Revision scalingsection:
      • Minimum number of instances: Enter 0 .
      • Maximum number of instances: Enter 100 (or adjust based on expected load).

12. Click Create.

13. Wait for the service to be created (1-2 minutes).

14. After the service is created, the inline code editorwill open automatically.

Add function code

1. Enter mainin the Entry pointfield.

2. In the inline code editor, create two files:

   • First file: main.py:

     import 
     
    functions_framework 
    from 
     
    google.cloud 
     
    import 
     storage 
    
    import 
     
    json 
    import 
     
    os 
    import 
     
    urllib3 
    from 
     
    datetime 
     
    import 
    datetime 
    , 
    timezone 
    # Initialize HTTP client with timeouts 
    http 
    = 
    urllib3 
    . 
    PoolManager 
    ( 
    timeout 
    = 
    urllib3 
    . 
    Timeout 
    ( 
    connect 
    = 
    5.0 
    , 
    read 
    = 
    30.0 
    ), 
    retries 
    = 
    False 
    , 
    ) 
    # Initialize Storage client 
    storage_client 
    = 
     storage 
    
    . 
     Client 
    
    () 
    # Environment variables 
    GCS_BUCKET 
    = 
    os 
    . 
    environ 
    . 
    get 
    ( 
    'GCS_BUCKET' 
    ) 
    GCS_PREFIX 
    = 
    os 
    . 
    environ 
    . 
    get 
    ( 
    'GCS_PREFIX' 
    , 
    'openidm' 
    ) 
    STATE_KEY 
    = 
    os 
    . 
    environ 
    . 
    get 
    ( 
    'STATE_KEY' 
    , 
    'openidm/state.json' 
    ) 
    OPENIDM_BASE_URL 
    = 
    os 
    . 
    environ 
    . 
    get 
    ( 
    'OPENIDM_BASE_URL' 
    ) 
    OPENIDM_USERNAME 
    = 
    os 
    . 
    environ 
    . 
    get 
    ( 
    'OPENIDM_USERNAME' 
    ) 
    OPENIDM_PASSWORD 
    = 
    os 
    . 
    environ 
    . 
    get 
    ( 
    'OPENIDM_PASSWORD' 
    ) 
    AUDIT_TOPICS 
    = 
    os 
    . 
    environ 
    . 
    get 
    ( 
    'AUDIT_TOPICS' 
    , 
    'access,activity,authentication,config,sync' 
    ) 
    . 
    split 
    ( 
    ',' 
    ) 
    PAGE_SIZE 
    = 
    int 
    ( 
    os 
    . 
    environ 
    . 
    get 
    ( 
    'PAGE_SIZE' 
    , 
    '100' 
    )) 
    MAX_PAGES 
    = 
    int 
    ( 
    os 
    . 
    environ 
    . 
    get 
    ( 
    'MAX_PAGES' 
    , 
    '50' 
    )) 
    @functions_framework 
    . 
    cloud_event 
    def 
     
    main 
    ( 
    cloud_event 
    ): 
     
    """ 
    Cloud Run function triggered by Pub/Sub to fetch ForgeRock OpenIDM logs and write to GCS. 
    Args: 
    cloud_event: CloudEvent object containing Pub/Sub message 
    """ 
    if 
    not 
    all 
    ([ 
    GCS_BUCKET 
    , 
    OPENIDM_BASE_URL 
    , 
    OPENIDM_USERNAME 
    , 
    OPENIDM_PASSWORD 
    ]): 
    print 
    ( 
    'Error: Missing required environment variables' 
    ) 
    return 
    try 
    : 
    # Get GCS bucket 
    bucket 
    = 
    storage_client 
    . 
     bucket 
    
    ( 
    GCS_BUCKET 
    ) 
    # Load state 
    state 
    = 
    load_state 
    ( 
    bucket 
    , 
    STATE_KEY 
    ) 
    all_events 
    = 
    [] 
    for 
    topic 
    in 
    AUDIT_TOPICS 
    : 
    topic 
    = 
    topic 
    . 
    strip 
    () 
    print 
    ( 
    f 
    "Fetching audit logs for topic: 
    { 
    topic 
    } 
    " 
    ) 
    events 
    = 
    fetch_audit_logs 
    ( 
    topic 
    , 
     state 
    
    . 
    get 
    ( 
    topic 
    , 
    {})) 
    all_events 
    . 
    extend 
    ( 
    events 
    ) 
    if 
    events 
    : 
    latest_timestamp 
    = 
    max 
    ( 
    e 
    . 
    get 
    ( 
    'timestamp' 
    , 
    '' 
    ) 
    for 
    e 
    in 
    events 
    ) 
    state 
    [ 
    topic 
    ] 
    = 
    { 
    'last_timestamp' 
    : 
    latest_timestamp 
    , 
    'last_run' 
    : 
    datetime 
    . 
    now 
    ( 
    timezone 
    . 
    utc 
    ) 
    . 
    isoformat 
    (), 
    'events_count' 
    : 
    len 
    ( 
    events 
    ) 
    } 
    if 
    all_events 
    : 
    write_to_gcs 
    ( 
    bucket 
    , 
    all_events 
    ) 
    save_state 
    ( 
    bucket 
    , 
    STATE_KEY 
    , 
    state 
    ) 
    print 
    ( 
    f 
    "Successfully processed 
    { 
    len 
    ( 
    all_events 
    ) 
    } 
    audit events" 
    ) 
    else 
    : 
    print 
    ( 
    "No new audit events to process" 
    ) 
    except 
    Exception 
    as 
    e 
    : 
    print 
    ( 
    f 
    'Error processing logs: 
    { 
    str 
    ( 
    e 
    ) 
    } 
    ' 
    ) 
    raise 
    def 
     
    load_state 
    ( 
    bucket 
    , 
    key 
    ): 
     
    """Load state from GCS.""" 
    try 
    : 
    blob 
    = 
    bucket 
    . 
    blob 
    ( 
    key 
    ) 
    if 
    blob 
    . 
    exists 
    (): 
    state_data 
    = 
    blob 
    . 
     download_as_text 
    
    () 
    return 
    json 
    . 
    loads 
    ( 
    state_data 
    ) 
    except 
    Exception 
    as 
    e 
    : 
    print 
    ( 
    f 
    "Warning: Could not load state: 
    { 
    e 
    } 
    " 
    ) 
    return 
    {} 
    def 
     
    save_state 
    ( 
    bucket 
    , 
    key 
    , 
    state 
    ): 
     
    """Save state to GCS.""" 
    try 
    : 
    blob 
    = 
    bucket 
    . 
    blob 
    ( 
    key 
    ) 
    blob 
    . 
     upload_from_string 
    
    ( 
    json 
    . 
    dumps 
    ( 
    state 
    , 
    indent 
    = 
    2 
    ), 
    content_type 
    = 
    'application/json' 
    ) 
    print 
    ( 
    f 
    "Saved state: 
    { 
    json 
    . 
    dumps 
    ( 
    state 
    ) 
    } 
    " 
    ) 
    except 
    Exception 
    as 
    e 
    : 
    print 
    ( 
    f 
    "Warning: Could not save state: 
    { 
    e 
    } 
    " 
    ) 
    def 
     
    fetch_audit_logs 
    ( 
    topic 
    , 
    topic_state 
    ): 
     
    """ 
    Fetch audit logs from ForgeRock OpenIDM API with pagination. 
    Args: 
    topic: Audit topic name 
    topic_state: State dictionary for this topic 
    Returns: 
    List of audit events 
    """ 
    base_url 
    = 
    OPENIDM_BASE_URL 
    . 
    rstrip 
    ( 
    '/' 
    ) 
    all_events 
    = 
    [] 
    last_timestamp 
    = 
    topic_state 
    . 
    get 
    ( 
    'last_timestamp' 
    ) 
    query_filter 
    = 
    'true' 
    if 
    last_timestamp 
    : 
    query_filter 
    = 
    f 
    'timestamp gt " 
    { 
    last_timestamp 
    } 
    "' 
    page_offset 
    = 
    0 
    page_count 
    = 
    0 
    while 
    page_count 
   < MAX_PAGES 
    : 
    try 
    : 
    url 
    = 
    f 
    " 
    { 
    base_url 
    } 
    /openidm/audit/ 
    { 
    topic 
    } 
    " 
    params 
    = 
    { 
    '_queryFilter' 
    : 
    query_filter 
    , 
    '_pageSize' 
    : 
    str 
    ( 
    PAGE_SIZE 
    ), 
    '_pagedResultsOffset' 
    : 
    str 
    ( 
    page_offset 
    ), 
    '_sortKeys' 
    : 
    'timestamp' 
    } 
    query_string 
    = 
    '&' 
    . 
    join 
    ([ 
    f 
    " 
    { 
    k 
    } 
    = 
    { 
    urllib3 
    . 
    request 
    . 
    urlencode 
    ({ 
    k 
    : 
     
    v 
    })[ 
    len 
    ( 
    k 
    ) 
    + 
    1 
    :] 
    } 
    " 
    for 
    k 
    , 
    v 
    in 
    params 
    . 
    items 
    ()]) 
    full_url 
    = 
    f 
    " 
    { 
    url 
    } 
    ? 
    { 
    query_string 
    } 
    " 
    headers 
    = 
    { 
    'X-OpenIDM-Username' 
    : 
    OPENIDM_USERNAME 
    , 
    'X-OpenIDM-Password' 
    : 
    OPENIDM_PASSWORD 
    , 
    'Accept-API-Version' 
    : 
    'resource=1.0' 
    , 
    'Accept' 
    : 
    'application/json' 
    } 
    response 
    = 
    http 
    . 
    request 
    ( 
    'GET' 
    , 
    full_url 
    , 
    headers 
    = 
    headers 
    ) 
    if 
    response 
    . 
    status 
    != 
    200 
    : 
    print 
    ( 
    f 
    "API error for topic 
    { 
    topic 
    } 
    : 
    { 
    response 
    . 
    status 
    } 
    - 
    { 
    response 
    . 
    data 
    . 
    decode 
    ( 
    'utf-8' 
    ) 
    } 
    " 
    ) 
    break 
    data 
    = 
    json 
    . 
    loads 
    ( 
    response 
    . 
    data 
    . 
    decode 
    ( 
    'utf-8' 
    )) 
    events 
    = 
    data 
    . 
    get 
    ( 
    'result' 
    , 
    []) 
    if 
    not 
    events 
    : 
    print 
    ( 
    f 
    "No more events for topic 
    { 
    topic 
    } 
    " 
    ) 
    break 
    all_events 
    . 
    extend 
    ( 
    events 
    ) 
    page_offset 
    += 
    PAGE_SIZE 
    page_count 
    += 
    1 
    print 
    ( 
    f 
    "Fetched page 
    { 
    page_count 
    } 
    for topic 
    { 
    topic 
    } 
    , total events: 
    { 
    len 
    ( 
    all_events 
    ) 
    } 
    " 
    ) 
    if 
    len 
    ( 
    events 
    ) 
   < PAGE_SIZE 
    : 
    break 
    except 
    urllib3 
    . 
     exceptions 
    
    . 
    HTTPError 
    as 
    e 
    : 
    print 
    ( 
    f 
    "HTTP error for topic 
    { 
    topic 
    } 
    : 
    { 
    str 
    ( 
    e 
    ) 
    } 
    " 
    ) 
    break 
    except 
    json 
    . 
    JSONDecodeError 
    as 
    e 
    : 
    print 
    ( 
    f 
    "JSON decode error for topic 
    { 
    topic 
    } 
    : 
    { 
    str 
    ( 
    e 
    ) 
    } 
    " 
    ) 
    break 
    except 
    Exception 
    as 
    e 
    : 
    print 
    ( 
    f 
    "Unexpected error for topic 
    { 
    topic 
    } 
    : 
    { 
    str 
    ( 
    e 
    ) 
    } 
    " 
    ) 
    break 
    return 
    all_events 
    def 
     
    write_to_gcs 
    ( 
    bucket 
    , 
    events 
    ): 
     
    """Write events to GCS as NDJSON.""" 
    timestamp 
    = 
    datetime 
    . 
    now 
    ( 
    timezone 
    . 
    utc 
    ) 
    . 
    strftime 
    ( 
    '%Y%m 
    %d 
    _%H%M%S' 
    ) 
    filename 
    = 
    f 
    " 
    { 
    GCS_PREFIX 
    } 
    /openidm_audit_ 
    { 
    timestamp 
    } 
    .json" 
    ndjson_content 
    = 
    ' 
    \n 
    ' 
    . 
    join 
    ([ 
    json 
    . 
    dumps 
    ( 
    event 
    ) 
    for 
    event 
    in 
    events 
    ]) 
    blob 
    = 
    bucket 
    . 
    blob 
    ( 
    filename 
    ) 
    blob 
    . 
     upload_from_string 
    
    ( 
    ndjson_content 
    . 
    encode 
    ( 
    'utf-8' 
    ), 
    content_type 
    = 
    'application/x-ndjson' 
    ) 
    print 
    ( 
    f 
    "Wrote 
    { 
    len 
    ( 
    events 
    ) 
    } 
    events to gs:// 
    { 
    GCS_BUCKET 
    } 
    / 
    { 
    filename 
    } 
    " 
    ) 
    
   

   • Second file: requirements.txt:

    functions-framework==3.*
   google-cloud-storage==2.*
   urllib3>=2.0.0 
   

3. Click Deployto save and deploy the function.

4. Wait for deployment to complete (2-3 minutes).

Create Cloud Scheduler job

Cloud Scheduler will publish messages to the Pub/Sub topic at regular intervals, triggering the Cloud Run function.

1. In the GCP Console, go to Cloud Scheduler.
2. Click Create Job.

3. Provide the following configuration details:

   Setting	Value
   Name	forgerock-openidm-collector-hourly
   Region	Select same region as Cloud Run function
   Frequency	0 * * * * (every hour, on the hour)
   Timezone	Select timezone (UTC recommended)
   Target type	Pub/Sub
   Topic	Select the Pub/Sub topic forgerock-openidm-trigger
   Message body	{} (empty JSON object)

4. Click Create.

Schedule frequency options

Choose the frequency based on log volume and latency requirements:

Test the integration

1. In the Cloud Schedulerconsole, find your job forgerock-openidm-collector-hourly .
2. Click Force runto trigger the job manually.
3. Wait a few seconds.
4. Go to Cloud Run > Services.
5. Click your function name forgerock-openidm-collector .
6. Click the Logstab.

7. Verify the function executed successfully. Look for:

    Fetching audit logs for topic: access
   Fetched page 1 for topic access, total events: X
   Wrote X events to gs://forgerock-openidm-audit-logs/openidm/openidm_audit_YYYYMMDD_HHMMSS.json
   Successfully processed X audit events 
   

8. Go to Cloud Storage > Buckets.

9. Click on your bucket name forgerock-openidm-audit-logs .

10. Navigate to the prefix folder openidm/ .

11. Verify that a new .json file was created with the current timestamp.

If you see errors in the logs:

• HTTP 401: Check OpenIDM credentials in environment variables
• HTTP 403: Verify account has audit read permissions
• HTTP 404: Verify OPENIDM_BASE_URL is correct and does not include trailing paths
• Missing environment variables: Check all required variables are set

Retrieve the Google SecOps service account

Google SecOps uses a unique service account to read data from your GCS bucket. You must grant this service account access to your bucket.

Configure a feed in Google SecOps to ingest ForgeRock OpenIDM logs

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. Click Configure a single feed.
4. In the Feed namefield, enter a name for the feed (for example, ForgeRock OpenIDM Audit Logs ).
5. Select Google Cloud Storage V2as the Source type.

6. Select FORGEROCK_OPENIDMas the Log type.

7. Click Get Service Account.

8. A unique service account email will be displayed, for example:

     chronicle 
    - 
    12345678 
    @chronicle 
    - 
    gcp 
    - 
    prod 
    . 
    iam 
    . 
    gserviceaccount 
    . 
    com 
    
   

9. Copy this email address. You will use it in the next step.

10. Click Next.

11. Specify values for the following input parameters:

    • Storage bucket URL: Enter the GCS bucket URI with the prefix path:

     gs://forgerock-openidm-audit-logs/openidm/ 
    

    • Replace:
      • forgerock-openidm-audit-logs : Your GCS bucket name.
      • openidm : The prefix path where logs are stored.
    • Source deletion option: Select the deletion option according to your preference:
      • Never: Never deletes any files after transfers (recommended for testing).
      • Delete transferred files: Deletes files after successful transfer.
      • Delete transferred files and empty directories: Deletes files and empty directories after successful transfer.
    • Maximum File Age: Include files modified in the last number of days. Default is 180 days.
    • Asset namespace: The asset namespace .
    • Ingestion labels: The label to be applied to the events from this feed.

12. Click Next.

13. Review your new feed configuration in the Finalizescreen, and then click Submit.

Grant IAM permissions to the Google SecOps service account

The Google SecOps service account needs Storage Object Viewerrole on your GCS bucket.

1. Go to Cloud Storage > Buckets.
2. Click your bucket name forgerock-openidm-audit-logs .
3. Go to the Permissionstab.
4. Click Grant access.
5. Provide the following configuration details:
   • Add principals: Paste the Google SecOps service account email.
   • Assign roles: Select Storage Object Viewer.

6. Click Save.

UDM mapping table

Need more help? Get answers from Community members and Google SecOps professionals.