Security Metrics #833
Description
When used in an Enterprise context as Identity Provider, it would be nice to be able to obtain high-level metrics about each auth transaction to monitor service quality and potential security/abuse issues.
Some of these metrics may include information such as:
- User Agent
- IP Address (mobile app)
- Presentation Request Id (which proof request was processed)
- Transaction (presentation exchange) Id
- Timestamp of the operation
- etc.
This loosely relates to #768 as it also focuses on service usage.
The course of action will likely be:
- Determine which metrics can be obtained by the service while preserving privacy-oriented interactions
- Determine how to turn these metrics on/off per deployment, and whether they can be fine-tuned (i.e.: choose what is logged)
- Implement code changes to add metric collection and storage