# \[BUG\] Authentication Challenge Audit Logs

**URL:** <https://forum.inductiveautomation.com/t/bug-authentication-challenge-audit-logs/102538>\
**Category:** Ignition\
**Tags:** perspective\
**Created:** [February 19, 2025, 9:08am UTC](https://forum.inductiveautomation.com/t/bug-authentication-challenge-audit-logs/102538 "2025-02-19T09:08:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chris\_Murphy](https://avatars.discourse-cdn.com/v4/letter/c/c5a1d2/32.png) [@Chris\_Murphy](https://forum.inductiveautomation.com/u/Chris_Murphy)\
**Post date:** [February 19, 2025, 9:08am UTC](https://forum.inductiveautomation.com/t/bug-authentication-challenge-audit-logs/102538/1 "2025-02-19T09:08:44Z")

</div>

Hi,

**1. The behavior you unexpectedly encountered**

I have a situation where several bypasses are possible so I use the authentication challenge to elevate and enable/disable bypasses.

This all works as expected, however the audit logs show the resulting tag write with the actor being the user logged into the session rather than the user that completed the auth challenge.

We use tag write permissions extensively. I have tested this behaviour to show that the tag write is in fact using the security levels of the auth challenge user to determine if the write is allowed, then it puts an entry in the audit log of the session user. This could even mean that it is logged as "Unauthenticated" performing the tag write.

**2. The behavior you were expecting to see**

I expect the audit log to show the actor of the action as the authentication challenge user

**3. A list of the steps you took that exposed the issue**

Create two users:

_ **operator** _ with role of _ **operator** _  
_ **admin** _ with role of _ **admin** _

Setup audit logging

Log in to perspective session as _ **operator** _

Raise an authentication challenge from a view.

Authenticate as _ **admin** _

Do a tag write in an authentication challenge handler.

Review the audit log and see that the tag write actor is _ **operator** _

I have also tested with various tag permissions to show that the write is only possible if the authentication challenge user has write permission on the tag, so it appears the user doing the write is known.

**4. A list of helpful information about the situation you were in**  
Ignition 8.1.45  
Perspective 2.1.45

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [February 19, 2025, 12:55pm UTC](https://forum.inductiveautomation.com/t/bug-authentication-challenge-audit-logs/102538/2 "2025-02-19T12:55:57Z")

</div>

Sounds like a bug worth reporting.