Merge branch 'main' of https://github.com/Infisical/infisical into feat/chef-data-bag-app-connection-secret-sync

backend/src/services/app-connection/app-connection-enums.ts

@@ -39,7 +39,8 @@ export enum AppConnection {
   Okta = "okta",
   Redis = "redis",
   LaravelForge = "laravel-forge",
-  Chef = "chef"
+  Chef = "chef",
+  Northflank = "northflank"
 }
 
 export enum AWSRegion {

backend/src/services/app-connection/app-connection-fns.ts

@@ -68,6 +68,7 @@ import {
 } from "./bitbucket";
 import { CamundaConnectionMethod, getCamundaConnectionListItem, validateCamundaConnectionCredentials } from "./camunda";
 import { ChecklyConnectionMethod, getChecklyConnectionListItem, validateChecklyConnectionCredentials } from "./checkly";
+import { ChefConnectionMethod, getChefConnectionListItem, validateChefConnectionCredentials } from "./chef";
 import { CloudflareConnectionMethod } from "./cloudflare/cloudflare-connection-enum";
 import {
   getCloudflareConnectionListItem,
@@ -113,6 +114,11 @@ import { getMsSqlConnectionListItem, MsSqlConnectionMethod } from "./mssql";
 import { MySqlConnectionMethod } from "./mysql/mysql-connection-enums";
 import { getMySqlConnectionListItem } from "./mysql/mysql-connection-fns";
 import { getNetlifyConnectionListItem, validateNetlifyConnectionCredentials } from "./netlify";
+import {
+  getNorthflankConnectionListItem,
+  NorthflankConnectionMethod,
+  validateNorthflankConnectionCredentials
+} from "./northflank";
 import { getOktaConnectionListItem, OktaConnectionMethod, validateOktaConnectionCredentials } from "./okta";
 import { getPostgresConnectionListItem, PostgresConnectionMethod } from "./postgres";
 import { getRailwayConnectionListItem, validateRailwayConnectionCredentials } from "./railway";
@@ -142,7 +148,6 @@ import {
   WindmillConnectionMethod
 } from "./windmill";
 import { getZabbixConnectionListItem, validateZabbixConnectionCredentials, ZabbixConnectionMethod } from "./zabbix";
-import { ChefConnectionMethod, getChefConnectionListItem, validateChefConnectionCredentials } from "./chef";
 
 const SECRET_SYNC_APP_CONNECTION_MAP = Object.fromEntries(
   Object.entries(SECRET_SYNC_CONNECTION_MAP).map(([key, value]) => [value, key])
@@ -204,6 +209,7 @@ export const listAppConnectionOptions = (projectType?: ProjectType) => {
     getSupabaseConnectionListItem(),
     getDigitalOceanConnectionListItem(),
     getNetlifyConnectionListItem(),
+    getNorthflankConnectionListItem(),
     getOktaConnectionListItem(),
     getRedisConnectionListItem(),
     getChefConnectionListItem()
@@ -334,10 +340,11 @@ export const validateAppConnectionCredentials = async (
     [AppConnection.Checkly]: validateChecklyConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Supabase]: validateSupabaseConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.DigitalOcean]: validateDigitalOceanConnectionCredentials as TAppConnectionCredentialsValidator,
-    [AppConnection.Okta]: validateOktaConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Netlify]: validateNetlifyConnectionCredentials as TAppConnectionCredentialsValidator,
-    [AppConnection.Redis]: validateRedisConnectionCredentials as TAppConnectionCredentialsValidator,
-    [AppConnection.Chef]: validateChefConnectionCredentials as TAppConnectionCredentialsValidator
+    [AppConnection.Northflank]: validateNorthflankConnectionCredentials as TAppConnectionCredentialsValidator,
+    [AppConnection.Okta]: validateOktaConnectionCredentials as TAppConnectionCredentialsValidator,
+    [AppConnection.Chef]: validateChefConnectionCredentials as TAppConnectionCredentialsValidator,
+    [AppConnection.Redis]: validateRedisConnectionCredentials as TAppConnectionCredentialsValidator
   };
 
   return VALIDATE_APP_CONNECTION_CREDENTIALS_MAP[appConnection.app](appConnection, gatewayService, gatewayV2Service);
@@ -379,6 +386,7 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
     case BitbucketConnectionMethod.ApiToken:
     case ZabbixConnectionMethod.ApiToken:
     case DigitalOceanConnectionMethod.ApiToken:
+    case NorthflankConnectionMethod.ApiToken:
     case OktaConnectionMethod.ApiToken:
     case LaravelForgeConnectionMethod.ApiToken:
       return "API Token";
@@ -477,6 +485,7 @@ export const TRANSITION_CONNECTION_CREDENTIALS_TO_PLATFORM: Record<
   [AppConnection.Supabase]: platformManagedCredentialsNotSupported,
   [AppConnection.DigitalOcean]: platformManagedCredentialsNotSupported,
   [AppConnection.Netlify]: platformManagedCredentialsNotSupported,
+  [AppConnection.Northflank]: platformManagedCredentialsNotSupported,
   [AppConnection.Okta]: platformManagedCredentialsNotSupported,
   [AppConnection.Redis]: platformManagedCredentialsNotSupported,
   [AppConnection.LaravelForge]: platformManagedCredentialsNotSupported,

backend/src/services/app-connection/app-connection-maps.ts

@@ -41,7 +41,8 @@ export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
   [AppConnection.Netlify]: "Netlify",
   [AppConnection.Okta]: "Okta",
   [AppConnection.Redis]: "Redis",
-  [AppConnection.Chef]: "Chef"
+  [AppConnection.Chef]: "Chef",
+  [AppConnection.Northflank]: "Northflank"
 };
 
 export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanType> = {
@@ -85,5 +86,6 @@ export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanTyp
   [AppConnection.Netlify]: AppConnectionPlanType.Regular,
   [AppConnection.Okta]: AppConnectionPlanType.Regular,
   [AppConnection.Redis]: AppConnectionPlanType.Regular,
-  [AppConnection.Chef]: AppConnectionPlanType.Regular
+  [AppConnection.Chef]: AppConnectionPlanType.Regular,
+  [AppConnection.Northflank]: AppConnectionPlanType.Regular
 };

backend/src/services/app-connection/app-connection-service.ts

@@ -98,6 +98,8 @@ import { ValidateMsSqlConnectionCredentialsSchema } from "./mssql";
 import { ValidateMySqlConnectionCredentialsSchema } from "./mysql";
 import { ValidateNetlifyConnectionCredentialsSchema } from "./netlify";
 import { netlifyConnectionService } from "./netlify/netlify-connection-service";
+import { ValidateNorthflankConnectionCredentialsSchema } from "./northflank";
+import { northflankConnectionService } from "./northflank/northflank-connection-service";
 import { ValidateOktaConnectionCredentialsSchema } from "./okta";
 import { oktaConnectionService } from "./okta/okta-connection-service";
 import { ValidatePostgresConnectionCredentialsSchema } from "./postgres";
@@ -172,6 +174,7 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
   [AppConnection.Supabase]: ValidateSupabaseConnectionCredentialsSchema,
   [AppConnection.DigitalOcean]: ValidateDigitalOceanConnectionCredentialsSchema,
   [AppConnection.Netlify]: ValidateNetlifyConnectionCredentialsSchema,
+  [AppConnection.Northflank]: ValidateNorthflankConnectionCredentialsSchema,
   [AppConnection.Okta]: ValidateOktaConnectionCredentialsSchema,
   [AppConnection.Redis]: ValidateRedisConnectionCredentialsSchema,
   [AppConnection.Chef]: ValidateChefConnectionCredentialsSchema
@@ -879,6 +882,7 @@ export const appConnectionServiceFactory = ({
     supabase: supabaseConnectionService(connectAppConnectionById),
     digitalOcean: digitalOceanAppPlatformConnectionService(connectAppConnectionById),
     netlify: netlifyConnectionService(connectAppConnectionById),
+    northflank: northflankConnectionService(connectAppConnectionById),
     okta: oktaConnectionService(connectAppConnectionById),
     laravelForge: laravelForgeConnectionService(connectAppConnectionById),
     chef: chefConnectionService(connectAppConnectionById)

backend/src/services/app-connection/app-connection-types.ts

@@ -168,6 +168,12 @@ import {
   TNetlifyConnectionInput,
   TValidateNetlifyConnectionCredentialsSchema
 } from "./netlify";
+import {
+  TNorthflankConnection,
+  TNorthflankConnectionConfig,
+  TNorthflankConnectionInput,
+  TValidateNorthflankConnectionCredentialsSchema
+} from "./northflank";
 import {
   TOktaConnection,
   TOktaConnectionConfig,
@@ -279,6 +285,7 @@ export type TAppConnection = { id: string } & (
   | TSupabaseConnection
   | TDigitalOceanConnection
   | TNetlifyConnection
+  | TNorthflankConnection
   | TOktaConnection
   | TRedisConnection
   | TChefConnection
@@ -327,6 +334,7 @@ export type TAppConnectionInput = { id: string } & (
   | TSupabaseConnectionInput
   | TDigitalOceanConnectionInput
   | TNetlifyConnectionInput
+  | TNorthflankConnectionInput
   | TOktaConnectionInput
   | TRedisConnectionInput
   | TChefConnectionInput
@@ -393,6 +401,7 @@ export type TAppConnectionConfig =
   | TSupabaseConnectionConfig
   | TDigitalOceanConnectionConfig
   | TNetlifyConnectionConfig
+  | TNorthflankConnectionConfig
   | TOktaConnectionConfig
   | TRedisConnectionConfig
   | TChefConnectionConfig;
@@ -436,6 +445,7 @@ export type TValidateAppConnectionCredentialsSchema =
   | TValidateSupabaseConnectionCredentialsSchema
   | TValidateDigitalOceanCredentialsSchema
   | TValidateNetlifyConnectionCredentialsSchema
+  | TValidateNorthflankConnectionCredentialsSchema
   | TValidateOktaConnectionCredentialsSchema
   | TValidateRedisConnectionCredentialsSchema
   | TValidateChefConnectionCredentialsSchema;

backend/src/services/app-connection/northflank/index.ts

@@ -0,0 +1,5 @@
+export * from "./northflank-connection-enums";
+export * from "./northflank-connection-fns";
+export * from "./northflank-connection-schemas";
+export * from "./northflank-connection-service";
+export * from "./northflank-connection-types";

backend/src/services/app-connection/northflank/northflank-connection-enums.ts

@@ -0,0 +1,3 @@
+export enum NorthflankConnectionMethod {
+  ApiToken = "api-token"
+}

backend/src/services/app-connection/northflank/northflank-connection-fns.ts

@@ -0,0 +1,114 @@
+import { AxiosError } from "axios";
+
+import { request } from "@app/lib/config/request";
+import { BadRequestError } from "@app/lib/errors";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+
+import { NorthflankConnectionMethod } from "./northflank-connection-enums";
+import {
+  TNorthflankConnection,
+  TNorthflankConnectionConfig,
+  TNorthflankProject,
+  TNorthflankSecretGroup
+} from "./northflank-connection-types";
+
+const NORTHFLANK_API_URL = "https://api.northflank.com";
+
+export const getNorthflankConnectionListItem = () => {
+  return {
+    name: "Northflank" as const,
+    app: AppConnection.Northflank as const,
+    methods: Object.values(NorthflankConnectionMethod)
+  };
+};
+
+export const validateNorthflankConnectionCredentials = async (config: TNorthflankConnectionConfig) => {
+  const { credentials } = config;
+
+  try {
+    await request.get(`${NORTHFLANK_API_URL}/v1/projects`, {
+      headers: {
+        Authorization: `Bearer ${credentials.apiToken}`,
+        Accept: "application/json"
+      }
+    });
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to validate Northflank credentials: ${error.message || "Unknown error"}`
+      });
+    }
+
+    throw new BadRequestError({
+      message: `Failed to validate Northflank credentials - verify API token is correct`
+    });
+  }
+
+  return credentials;
+};
+
+export const listProjects = async (appConnection: TNorthflankConnection): Promise<TNorthflankProject[]> => {
+  const { credentials } = appConnection;
+
+  try {
+    const {
+      data: {
+        data: { projects }
+      }
+    } = await request.get<{ data: { projects: TNorthflankProject[] } }>(`${NORTHFLANK_API_URL}/v1/projects`, {
+      headers: {
+        Authorization: `Bearer ${credentials.apiToken}`,
+        Accept: "application/json"
+      }
+    });
+
+    return projects;
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to list Northflank projects: ${error.message || "Unknown error"}`
+      });
+    }
+
+    throw new BadRequestError({
+      message: "Unable to list Northflank projects",
+      error
+    });
+  }
+};
+
+export const listSecretGroups = async (
+  appConnection: TNorthflankConnection,
+  projectId: string
+): Promise<TNorthflankSecretGroup[]> => {
+  const { credentials } = appConnection;
+
+  try {
+    const {
+      data: {
+        data: { secrets }
+      }
+    } = await request.get<{ data: { secrets: TNorthflankSecretGroup[] } }>(
+      `${NORTHFLANK_API_URL}/v1/projects/${projectId}/secrets`,
+      {
+        headers: {
+          Authorization: `Bearer ${credentials.apiToken}`,
+          Accept: "application/json"
+        }
+      }
+    );
+
+    return secrets;
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to list Northflank secret groups: ${error.message || "Unknown error"}`
+      });
+    }
+
+    throw new BadRequestError({
+      message: "Unable to list Northflank secret groups",
+      error
+    });
+  }
+};

backend/src/services/app-connection/northflank/northflank-connection-schemas.ts

@@ -0,0 +1,60 @@
+import z from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { NorthflankConnectionMethod } from "./northflank-connection-enums";
+
+export const NorthflankConnectionApiTokenCredentialsSchema = z.object({
+  apiToken: z.string().trim().min(1, "API Token required").describe(AppConnections.CREDENTIALS.NORTHFLANK.apiToken)
+});
+
+const BaseNorthflankConnectionSchema = BaseAppConnectionSchema.extend({
+  app: z.literal(AppConnection.Northflank)
+});
+
+export const NorthflankConnectionSchema = BaseNorthflankConnectionSchema.extend({
+  method: z.literal(NorthflankConnectionMethod.ApiToken),
+  credentials: NorthflankConnectionApiTokenCredentialsSchema
+});
+
+export const SanitizedNorthflankConnectionSchema = z.discriminatedUnion("method", [
+  BaseNorthflankConnectionSchema.extend({
+    method: z.literal(NorthflankConnectionMethod.ApiToken),
+    credentials: NorthflankConnectionApiTokenCredentialsSchema.pick({})
+  })
+]);
+
+export const ValidateNorthflankConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: z
+      .literal(NorthflankConnectionMethod.ApiToken)
+      .describe(AppConnections.CREATE(AppConnection.Northflank).method),
+    credentials: NorthflankConnectionApiTokenCredentialsSchema.describe(
+      AppConnections.CREATE(AppConnection.Northflank).credentials
+    )
+  })
+]);
+
+export const CreateNorthflankConnectionSchema = ValidateNorthflankConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.Northflank)
+);
+
+export const UpdateNorthflankConnectionSchema = z
+  .object({
+    credentials: NorthflankConnectionApiTokenCredentialsSchema.optional().describe(
+      AppConnections.UPDATE(AppConnection.Northflank).credentials
+    )
+  })
+  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.Northflank));
+
+export const NorthflankConnectionListItemSchema = z.object({
+  name: z.literal("Northflank"),
+  app: z.literal(AppConnection.Northflank),
+  methods: z.nativeEnum(NorthflankConnectionMethod).array()
+});

backend/src/services/app-connection/northflank/northflank-connection-service.ts

@@ -0,0 +1,50 @@
+import { logger } from "@app/lib/logger";
+import { OrgServiceActor } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  listProjects as getNorthflankProjects,
+  listSecretGroups as getNorthflankSecretGroups
+} from "./northflank-connection-fns";
+import { TNorthflankConnection, TNorthflankSecretGroup } from "./northflank-connection-types";
+
+type TGetAppConnectionFunc = (
+  app: AppConnection,
+  connectionId: string,
+  actor: OrgServiceActor
+) => Promise<TNorthflankConnection>;
+
+export const northflankConnectionService = (getAppConnection: TGetAppConnectionFunc) => {
+  const listProjects = async (connectionId: string, actor: OrgServiceActor) => {
+    const appConnection = await getAppConnection(AppConnection.Northflank, connectionId, actor);
+    try {
+      const projects = await getNorthflankProjects(appConnection);
+
+      return projects;
+    } catch (error) {
+      logger.error({ error, connectionId, actor: actor.type }, "Failed to establish connection with Northflank");
+      return [];
+    }
+  };
+
+  const listSecretGroups = async (
+    connectionId: string,
+    projectId: string,
+    actor: OrgServiceActor
+  ): Promise<TNorthflankSecretGroup[]> => {
+    const appConnection = await getAppConnection(AppConnection.Northflank, connectionId, actor);
+    try {
+      const secretGroups = await getNorthflankSecretGroups(appConnection, projectId);
+
+      return secretGroups;
+    } catch (error) {
+      logger.error({ error, connectionId, projectId, actor: actor.type }, "Failed to list Northflank secret groups");
+      return [];
+    }
+  };
+
+  return {
+    listProjects,
+    listSecretGroups
+  };
+};

backend/src/services/app-connection/northflank/northflank-connection-types.ts

@@ -0,0 +1,35 @@
+import z from "zod";
+
+import { DiscriminativePick } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  CreateNorthflankConnectionSchema,
+  NorthflankConnectionSchema,
+  ValidateNorthflankConnectionCredentialsSchema
+} from "./northflank-connection-schemas";
+
+export type TNorthflankConnection = z.infer<typeof NorthflankConnectionSchema>;
+
+export type TNorthflankConnectionInput = z.infer<typeof CreateNorthflankConnectionSchema> & {
+  app: AppConnection.Northflank;
+};
+
+export type TValidateNorthflankConnectionCredentialsSchema = typeof ValidateNorthflankConnectionCredentialsSchema;
+
+export type TNorthflankConnectionConfig = DiscriminativePick<
+  TNorthflankConnection,
+  "method" | "app" | "credentials"
+> & {
+  orgId: string;
+};
+
+export type TNorthflankProject = {
+  id: string;
+  name: string;
+};
+
+export type TNorthflankSecretGroup = {
+  id: string;
+  name: string;
+};

backend/src/services/auth-token/auth-token-service.ts

@@ -210,6 +210,7 @@ export const tokenServiceFactory = ({ tokenDAL, userDAL, membershipUserDAL, orgD
     if (!user || !user.isAccepted) throw new NotFoundError({ message: `User with ID '${session.userId}' not found` });
 
     let orgId = "";
+    let orgName = "";
     let rootOrgId = "";
     let parentOrgId = "";
     if (token.organizationId) {
@@ -235,9 +236,11 @@ export const tokenServiceFactory = ({ tokenDAL, userDAL, membershipUserDAL, orgD
           throw new ForbiddenRequestError({ message: "User organization membership is inactive" });
         }
         orgId = subOrganization.id;
+        orgName = subOrganization.name;
         rootOrgId = token.organizationId;
         parentOrgId = subOrganization.parentOrgId as string;
       } else {
+        const organization = await orgDAL.findOne({ id: token.organizationId });
         const orgMembership = await membershipUserDAL.findOne({
           actorUserId: user.id,
           scopeOrgId: token.organizationId,
@@ -253,12 +256,13 @@ export const tokenServiceFactory = ({ tokenDAL, userDAL, membershipUserDAL, orgD
         }
 
         orgId = token.organizationId;
+        orgName = organization.name;
         rootOrgId = token.organizationId;
         parentOrgId = token.organizationId;
       }
     }
 
-    return { user, tokenVersionId: token.tokenVersionId, orgId, rootOrgId, parentOrgId };
+    return { user, tokenVersionId: token.tokenVersionId, orgId, orgName, rootOrgId, parentOrgId };
   };
 
   return {

backend/src/services/auth/auth-login-service.ts

@@ -16,6 +16,7 @@ import { getUserPrivateKey } from "@app/lib/crypto/srp";
 import { BadRequestError, DatabaseError, ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors";
 import { getMinExpiresIn, removeTrailingSlash } from "@app/lib/fn";
 import { logger } from "@app/lib/logger";
+import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 import { getUserAgentType } from "@app/server/plugins/audit-log";
 import { getServerCfg } from "@app/services/super-admin/super-admin-service";
 
@@ -385,63 +386,94 @@ export const authLoginServiceFactory = ({
     providerAuthToken?: string;
     captchaToken?: string;
   }) => {
-    const usersByUsername = await userDAL.findUserEncKeyByUsername({
-      username: email
-    });
-    const userEnc =
-      usersByUsername?.length > 1 ? usersByUsername.find((el) => el.username === email) : usersByUsername?.[0];
+    const appCfg = getConfig();
 
-    if (!userEnc) throw new BadRequestError({ message: "User not found" });
+    try {
+      const usersByUsername = await userDAL.findUserEncKeyByUsername({
+        username: email
+      });
+      const userEnc =
+        usersByUsername?.length > 1 ? usersByUsername.find((el) => el.username === email) : usersByUsername?.[0];
 
-    if (userEnc.encryptionVersion !== UserEncryption.V2) {
-      throw new BadRequestError({ message: "Legacy encryption scheme not supported", name: "LegacyEncryptionScheme" });
-    }
+      if (!userEnc) throw new BadRequestError({ message: "User not found" });
 
-    if (!userEnc.hashedPassword) {
-      if (userEnc.authMethods?.includes(AuthMethod.EMAIL)) {
+      if (userEnc.encryptionVersion !== UserEncryption.V2) {
         throw new BadRequestError({
           message: "Legacy encryption scheme not supported",
           name: "LegacyEncryptionScheme"
         });
       }
 
-      throw new BadRequestError({ message: "No password found" });
-    }
-
-    const { authMethod, organizationId } = getAuthMethodAndOrgId(email, providerAuthToken);
-    await verifyCaptcha(userEnc, captchaToken);
-
-    if (!(await crypto.hashing().compareHash(password, userEnc.hashedPassword))) {
-      await userDAL.update(
-        { id: userEnc.userId },
-        {
-          $incr: {
-            consecutiveFailedPasswordAttempts: 1
-          }
+      if (!userEnc.hashedPassword) {
+        if (userEnc.authMethods?.includes(AuthMethod.EMAIL)) {
+          throw new BadRequestError({
+            message: "Legacy encryption scheme not supported",
+            name: "LegacyEncryptionScheme"
+          });
         }
-      );
 
-      throw new BadRequestError({ message: "Invalid username or email" });
+        throw new BadRequestError({ message: "No password found" });
+      }
+
+      const { authMethod, organizationId } = getAuthMethodAndOrgId(email, providerAuthToken);
+      await verifyCaptcha(userEnc, captchaToken);
+
+      if (!(await crypto.hashing().compareHash(password, userEnc.hashedPassword))) {
+        await userDAL.update(
+          { id: userEnc.userId },
+          {
+            $incr: {
+              consecutiveFailedPasswordAttempts: 1
+            }
+          }
+        );
+
+        throw new BadRequestError({ message: "Invalid username or email" });
+      }
+
+      const token = await generateUserTokens({
+        user: {
+          ...userEnc,
+          id: userEnc.userId
+        },
+        ip,
+        userAgent,
+        authMethod,
+        organizationId
+      });
+
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.organization.id": organizationId,
+          "infisical.user.email": email,
+          "infisical.user.id": userEnc.userId,
+          "infisical.auth.method": AuthAttemptAuthMethod.EMAIL,
+          "infisical.auth.result": AuthAttemptAuthResult.SUCCESS,
+          "client.address": ip,
+          "user_agent.original": userAgent
+        });
+      }
+
+      return {
+        tokens: {
+          accessToken: token.access,
+          refreshToken: token.refresh
+        },
+        user: userEnc
+      } as const;
+    } catch (error) {
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.user.email": email,
+          "infisical.auth.method": AuthAttemptAuthMethod.EMAIL,
+          "infisical.auth.result": AuthAttemptAuthResult.FAILURE,
+          "client.address": ip,
+          "user_agent.original": userAgent
+        });
+      }
+
+      throw error;
     }
-
-    const token = await generateUserTokens({
-      user: {
-        ...userEnc,
-        id: userEnc.userId
-      },
-      ip,
-      userAgent,
-      authMethod,
-      organizationId
-    });
-
-    return {
-      tokens: {
-        accessToken: token.access,
-        refreshToken: token.refresh
-      },
-      user: userEnc
-    } as const;
   };
 
   const selectOrganization = async ({
@@ -965,7 +997,8 @@ export const authLoginServiceFactory = ({
         expiresIn: appCfg.JWT_PROVIDER_AUTH_LIFETIME
       }
     );
-    return { isUserCompleted, providerAuthToken };
+
+    return { isUserCompleted, providerAuthToken, user, orgId, orgName };
   };
 
   /**

backend/src/services/identity-access-token/identity-access-token-service.ts

@@ -210,6 +210,7 @@ export const identityAccessTokenServiceFactory = ({
       });
     }
     let orgId = "";
+    let orgName = "";
     let parentOrgId = "";
     const identityOrgDetails = await orgDAL.findOne({ id: identityAccessToken.identityScopeOrgId });
     const rootOrgId = identityOrgDetails.rootOrgId || identityOrgDetails.id;
@@ -229,8 +230,12 @@ export const identityAccessTokenServiceFactory = ({
         throw new BadRequestError({ message: "Identity does not belong to any organization" });
       }
       orgId = subOrganization.id;
+      orgName = subOrganization.name;
+
       parentOrgId = subOrganization.parentOrgId as string;
     } else {
+      const organization = await orgDAL.findOne({ id: rootOrgId });
+
       const identityOrgMembership = await membershipIdentityDAL.findOne({
         scope: AccessScope.Organization,
         actorIdentityId: identityAccessToken.identityId,
@@ -242,6 +247,7 @@ export const identityAccessTokenServiceFactory = ({
       }
 
       orgId = rootOrgId;
+      orgName = organization.name;
       parentOrgId = rootOrgId;
     }
 
@@ -253,7 +259,7 @@ export const identityAccessTokenServiceFactory = ({
     await validateAccessTokenExp({ ...identityAccessToken, accessTokenNumUses });
 
     await accessTokenQueue.updateIdentityAccessTokenStatus(identityAccessToken.id, Number(accessTokenNumUses) + 1);
-    return { ...identityAccessToken, orgId, rootOrgId, parentOrgId };
+    return { ...identityAccessToken, orgId, rootOrgId, parentOrgId, orgName };
   };
 
   return { renewAccessToken, revokeAccessToken, fnValidateIdentityAccessToken };

backend/src/services/identity-alicloud-auth/identity-alicloud-auth-service.ts

@@ -1,5 +1,6 @@
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
 import { ForbiddenError } from "@casl/ability";
+import { requestContext } from "@fastify/request-context";
 import { AxiosError } from "axios";
 
 import { AccessScope, IdentityAuthMethod, OrganizationActionScope } from "@app/db/schemas";
@@ -22,6 +23,7 @@ import {
 } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 import { logger } from "@app/lib/logger";
+import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
 import { TIdentityDALFactory } from "../identity/identity-dal";
@@ -65,6 +67,7 @@ export const identityAliCloudAuthServiceFactory = ({
   orgDAL
 }: TIdentityAliCloudAuthServiceFactoryDep) => {
   const login = async ({ identityId, ...params }: TLoginAliCloudAuthDTO) => {
+    const appCfg = getConfig();
     const identityAliCloudAuth = await identityAliCloudAuthDAL.findOne({ identityId });
     if (!identityAliCloudAuth) {
       throw new NotFoundError({
@@ -75,73 +78,103 @@ export const identityAliCloudAuthServiceFactory = ({
     const identity = await identityDAL.findById(identityAliCloudAuth.identityId);
     if (!identity) throw new UnauthorizedError({ message: "Identity not found" });
 
-    const requestUrl = new URL("https://sts.aliyuncs.com");
+    const org = await orgDAL.findById(identity.orgId);
 
-    for (const key of Object.keys(params)) {
-      requestUrl.searchParams.set(key, (params as Record<string, string>)[key]);
-    }
+    try {
+      const requestUrl = new URL("https://sts.aliyuncs.com");
 
-    const { data } = await request.get<TAliCloudGetUserResponse>(requestUrl.toString()).catch((err: AxiosError) => {
-      logger.error(err.response, "AliCloudIdentityLogin: Failed to authenticate with Alibaba Cloud");
-      throw err;
-    });
+      for (const key of Object.keys(params)) {
+        requestUrl.searchParams.set(key, (params as Record<string, string>)[key]);
+      }
 
-    if (identityAliCloudAuth.allowedArns) {
-      // In the future we could do partial checks for role ARNs
-      const isAccountAllowed = identityAliCloudAuth.allowedArns.split(",").some((arn) => arn.trim() === data.Arn);
+      const { data } = await request.get<TAliCloudGetUserResponse>(requestUrl.toString()).catch((err: AxiosError) => {
+        logger.error(err.response, "AliCloudIdentityLogin: Failed to authenticate with Alibaba Cloud");
+        throw err;
+      });
 
-      if (!isAccountAllowed)
-        throw new UnauthorizedError({
-          message: "Access denied: Alibaba Cloud account ARN not allowed."
-        });
-    }
+      if (identityAliCloudAuth.allowedArns) {
+        // In the future we could do partial checks for role ARNs
+        const isAccountAllowed = identityAliCloudAuth.allowedArns.split(",").some((arn) => arn.trim() === data.Arn);
 
-    // Generate the token
-    const identityAccessToken = await identityAliCloudAuthDAL.transaction(async (tx) => {
-      await membershipIdentityDAL.update(
-        { scope: AccessScope.Organization, scopeOrgId: identity.orgId, actorIdentityId: identity.id },
-        {
-          lastLoginAuthMethod: IdentityAuthMethod.ALICLOUD_AUTH,
-          lastLoginTime: new Date()
-        },
-        tx
-      );
-      const newToken = await identityAccessTokenDAL.create(
+        if (!isAccountAllowed)
+          throw new UnauthorizedError({
+            message: "Access denied: Alibaba Cloud account ARN not allowed."
+          });
+      }
+
+      // Generate the token
+      const identityAccessToken = await identityAliCloudAuthDAL.transaction(async (tx) => {
+        await membershipIdentityDAL.update(
+          { scope: AccessScope.Organization, scopeOrgId: identity.orgId, actorIdentityId: identity.id },
+          {
+            lastLoginAuthMethod: IdentityAuthMethod.ALICLOUD_AUTH,
+            lastLoginTime: new Date()
+          },
+          tx
+        );
+        const newToken = await identityAccessTokenDAL.create(
+          {
+            identityId: identityAliCloudAuth.identityId,
+            isAccessTokenRevoked: false,
+            accessTokenTTL: identityAliCloudAuth.accessTokenTTL,
+            accessTokenMaxTTL: identityAliCloudAuth.accessTokenMaxTTL,
+            accessTokenNumUses: 0,
+            accessTokenNumUsesLimit: identityAliCloudAuth.accessTokenNumUsesLimit,
+            authMethod: IdentityAuthMethod.ALICLOUD_AUTH
+          },
+          tx
+        );
+        return newToken;
+      });
+
+      const accessToken = crypto.jwt().sign(
         {
           identityId: identityAliCloudAuth.identityId,
-          isAccessTokenRevoked: false,
-          accessTokenTTL: identityAliCloudAuth.accessTokenTTL,
-          accessTokenMaxTTL: identityAliCloudAuth.accessTokenMaxTTL,
-          accessTokenNumUses: 0,
-          accessTokenNumUsesLimit: identityAliCloudAuth.accessTokenNumUsesLimit,
-          authMethod: IdentityAuthMethod.ALICLOUD_AUTH
-        },
-        tx
+          identityAccessTokenId: identityAccessToken.id,
+          authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
+        } as TIdentityAccessTokenJwtPayload,
+        appCfg.AUTH_SECRET,
+        Number(identityAccessToken.accessTokenTTL) === 0
+          ? undefined
+          : {
+              expiresIn: Number(identityAccessToken.accessTokenTTL)
+            }
       );
-      return newToken;
-    });
 
-    const appCfg = getConfig();
-    const accessToken = crypto.jwt().sign(
-      {
-        identityId: identityAliCloudAuth.identityId,
-        identityAccessTokenId: identityAccessToken.id,
-        authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
-      } as TIdentityAccessTokenJwtPayload,
-      appCfg.AUTH_SECRET,
-      Number(identityAccessToken.accessTokenTTL) === 0
-        ? undefined
-        : {
-            expiresIn: Number(identityAccessToken.accessTokenTTL)
-          }
-    );
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.identity.id": identityAliCloudAuth.identityId,
+          "infisical.identity.name": identity.name,
+          "infisical.organization.id": org.id,
+          "infisical.organization.name": org.name,
+          "infisical.identity.auth_method": AuthAttemptAuthMethod.ALICLOUD_AUTH,
+          "infisical.identity.auth_result": AuthAttemptAuthResult.SUCCESS,
+          "client.address": requestContext.get("ip"),
+          "user_agent.original": requestContext.get("userAgent")
+        });
+      }
 
-    return {
-      identityAliCloudAuth,
-      accessToken,
-      identityAccessToken,
-      identity
-    };
+      return {
+        identityAliCloudAuth,
+        accessToken,
+        identityAccessToken,
+        identity
+      };
+    } catch (error) {
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.identity.id": identityAliCloudAuth.identityId,
+          "infisical.identity.name": identity.name,
+          "infisical.organization.id": org.id,
+          "infisical.organization.name": org.name,
+          "infisical.identity.auth_method": AuthAttemptAuthMethod.ALICLOUD_AUTH,
+          "infisical.identity.auth_result": AuthAttemptAuthResult.FAILURE,
+          "client.address": requestContext.get("ip"),
+          "user_agent.original": requestContext.get("userAgent")
+        });
+      }
+      throw error;
+    }
   };
 
   const attachAliCloudAuth = async ({

backend/src/services/identity-aws-auth/identity-aws-auth-service.ts

@@ -1,5 +1,6 @@
-/* eslint-disable @typescript-eslint/no-unsafe-assignment */
+/* eslint-disable @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-member-access */
 import { ForbiddenError } from "@casl/ability";
+import { requestContext } from "@fastify/request-context";
 import axios from "axios";
 import RE2 from "re2";
 
@@ -22,6 +23,7 @@ import {
 } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 import { logger } from "@app/lib/logger";
+import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
 import { TIdentityDALFactory } from "../identity/identity-dal";
@@ -98,6 +100,7 @@ export const identityAwsAuthServiceFactory = ({
   orgDAL
 }: TIdentityAwsAuthServiceFactoryDep) => {
   const login = async ({ identityId, iamHttpRequestMethod, iamRequestBody, iamRequestHeaders }: TLoginAwsAuthDTO) => {
+    const appCfg = getConfig();
     const identityAwsAuth = await identityAwsAuthDAL.findOne({ identityId });
     if (!identityAwsAuth) {
       throw new NotFoundError({ message: "AWS auth method not found for identity, did you configure AWS auth?" });
@@ -106,127 +109,156 @@ export const identityAwsAuthServiceFactory = ({
     const identity = await identityDAL.findById(identityAwsAuth.identityId);
     if (!identity) throw new UnauthorizedError({ message: "Identity not found" });
 
-    const headers: TAwsGetCallerIdentityHeaders = JSON.parse(Buffer.from(iamRequestHeaders, "base64").toString());
-    const body: string = Buffer.from(iamRequestBody, "base64").toString();
+    const org = await orgDAL.findById(identity.orgId);
+    try {
+      const headers: TAwsGetCallerIdentityHeaders = JSON.parse(Buffer.from(iamRequestHeaders, "base64").toString());
+      const body: string = Buffer.from(iamRequestBody, "base64").toString();
 
-    const authHeader = headers.Authorization || headers.authorization;
-    const region = authHeader ? awsRegionFromHeader(authHeader) : null;
+      const authHeader = headers.Authorization || headers.authorization;
+      const region = authHeader ? awsRegionFromHeader(authHeader) : null;
 
-    if (!isValidAwsRegion(region)) {
-      throw new BadRequestError({ message: "Invalid AWS region" });
-    }
+      if (!isValidAwsRegion(region)) {
+        throw new BadRequestError({ message: "Invalid AWS region" });
+      }
 
-    const url = region ? `https://sts.${region}.amazonaws.com` : identityAwsAuth.stsEndpoint;
+      const url = region ? `https://sts.${region}.amazonaws.com` : identityAwsAuth.stsEndpoint;
 
-    const {
-      data: {
-        GetCallerIdentityResponse: {
-          GetCallerIdentityResult: { Account, Arn, UserId }
+      const {
+        data: {
+          GetCallerIdentityResponse: {
+            GetCallerIdentityResult: { Account, Arn, UserId }
+          }
+        }
+      }: { data: TGetCallerIdentityResponse } = await axios({
+        method: iamHttpRequestMethod,
+        url,
+        headers,
+        data: body
+      });
+
+      if (identityAwsAuth.allowedAccountIds) {
+        // validate if Account is in the list of allowed Account IDs
+
+        const isAccountAllowed = identityAwsAuth.allowedAccountIds
+          .split(",")
+          .map((accountId) => accountId.trim())
+          .some((accountId) => accountId === Account);
+
+        if (!isAccountAllowed)
+          throw new UnauthorizedError({
+            message: "Access denied: AWS account ID not allowed."
+          });
+      }
+
+      if (identityAwsAuth.allowedPrincipalArns) {
+        // validate if Arn is in the list of allowed Principal ARNs
+
+        const formattedArn = extractPrincipalArn(Arn);
+
+        const isArnAllowed = identityAwsAuth.allowedPrincipalArns
+          .split(",")
+          .map((principalArn) => principalArn.trim())
+          .some((principalArn) => {
+            // convert wildcard ARN to a regular expression: "arn:aws:iam::123456789012:*" -> "^arn:aws:iam::123456789012:.*$"
+            // considers exact matches + wildcard matches
+            // heavily validated in router
+            const regex = new RE2(`^${principalArn.replaceAll("*", ".*")}$`);
+            return regex.test(formattedArn) || regex.test(extractPrincipalArn(Arn, true));
+          });
+
+        if (!isArnAllowed) {
+          logger.error(
+            `AWS Auth Login: AWS principal ARN not allowed [principal-arn=${formattedArn}] [raw-arn=${Arn}] [identity-id=${identity.id}]`
+          );
+
+          throw new UnauthorizedError({
+            message: `Access denied: AWS principal ARN not allowed. [principal-arn=${formattedArn}]`
+          });
         }
       }
-    }: { data: TGetCallerIdentityResponse } = await axios({
-      method: iamHttpRequestMethod,
-      url,
-      headers,
-      data: body
-    });
 
-    if (identityAwsAuth.allowedAccountIds) {
-      // validate if Account is in the list of allowed Account IDs
-
-      const isAccountAllowed = identityAwsAuth.allowedAccountIds
-        .split(",")
-        .map((accountId) => accountId.trim())
-        .some((accountId) => accountId === Account);
-
-      if (!isAccountAllowed)
-        throw new UnauthorizedError({
-          message: "Access denied: AWS account ID not allowed."
-        });
-    }
-
-    if (identityAwsAuth.allowedPrincipalArns) {
-      // validate if Arn is in the list of allowed Principal ARNs
-
-      const formattedArn = extractPrincipalArn(Arn);
-
-      const isArnAllowed = identityAwsAuth.allowedPrincipalArns
-        .split(",")
-        .map((principalArn) => principalArn.trim())
-        .some((principalArn) => {
-          // convert wildcard ARN to a regular expression: "arn:aws:iam::123456789012:*" -> "^arn:aws:iam::123456789012:.*$"
-          // considers exact matches + wildcard matches
-          // heavily validated in router
-          const regex = new RE2(`^${principalArn.replaceAll("*", ".*")}$`);
-          return regex.test(formattedArn) || regex.test(extractPrincipalArn(Arn, true));
-        });
-
-      if (!isArnAllowed) {
-        logger.error(
-          `AWS Auth Login: AWS principal ARN not allowed [principal-arn=${formattedArn}] [raw-arn=${Arn}] [identity-id=${identity.id}]`
+      const identityAccessToken = await identityAwsAuthDAL.transaction(async (tx) => {
+        await membershipIdentityDAL.update(
+          { scope: AccessScope.Organization, scopeOrgId: identity.orgId, actorIdentityId: identity.id },
+          {
+            lastLoginAuthMethod: IdentityAuthMethod.AWS_AUTH,
+            lastLoginTime: new Date()
+          },
+          tx
         );
+        const newToken = await identityAccessTokenDAL.create(
+          {
+            identityId: identityAwsAuth.identityId,
+            isAccessTokenRevoked: false,
+            accessTokenTTL: identityAwsAuth.accessTokenTTL,
+            accessTokenMaxTTL: identityAwsAuth.accessTokenMaxTTL,
+            accessTokenNumUses: 0,
+            accessTokenNumUsesLimit: identityAwsAuth.accessTokenNumUsesLimit,
+            authMethod: IdentityAuthMethod.AWS_AUTH
+          },
+          tx
+        );
+        return newToken;
+      });
 
-        throw new UnauthorizedError({
-          message: `Access denied: AWS principal ARN not allowed. [principal-arn=${formattedArn}]`
-        });
-      }
-    }
-
-    const identityAccessToken = await identityAwsAuthDAL.transaction(async (tx) => {
-      await membershipIdentityDAL.update(
-        { scope: AccessScope.Organization, scopeOrgId: identity.orgId, actorIdentityId: identity.id },
-        {
-          lastLoginAuthMethod: IdentityAuthMethod.AWS_AUTH,
-          lastLoginTime: new Date()
-        },
-        tx
-      );
-      const newToken = await identityAccessTokenDAL.create(
+      const splitArn = extractPrincipalArnEntity(Arn);
+      const accessToken = crypto.jwt().sign(
         {
           identityId: identityAwsAuth.identityId,
-          isAccessTokenRevoked: false,
-          accessTokenTTL: identityAwsAuth.accessTokenTTL,
-          accessTokenMaxTTL: identityAwsAuth.accessTokenMaxTTL,
-          accessTokenNumUses: 0,
-          accessTokenNumUsesLimit: identityAwsAuth.accessTokenNumUsesLimit,
-          authMethod: IdentityAuthMethod.AWS_AUTH
-        },
-        tx
+          identityAccessTokenId: identityAccessToken.id,
+          authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN,
+          identityAuth: {
+            aws: {
+              accountId: Account,
+              arn: Arn,
+              userId: UserId,
+
+              // Derived from ARN
+              partition: splitArn.Partition,
+              service: splitArn.Service,
+              resourceType: splitArn.Type,
+              resourceName: splitArn.FriendlyName
+            }
+          }
+        } as TIdentityAccessTokenJwtPayload,
+        appCfg.AUTH_SECRET,
+        // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
+        Number(identityAccessToken.accessTokenTTL) === 0
+          ? undefined
+          : {
+              expiresIn: Number(identityAccessToken.accessTokenTTL)
+            }
       );
-      return newToken;
-    });
 
-    const appCfg = getConfig();
-    const splitArn = extractPrincipalArnEntity(Arn);
-    const accessToken = crypto.jwt().sign(
-      {
-        identityId: identityAwsAuth.identityId,
-        identityAccessTokenId: identityAccessToken.id,
-        authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN,
-        identityAuth: {
-          aws: {
-            accountId: Account,
-            arn: Arn,
-            userId: UserId,
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.identity.id": identityAwsAuth.identityId,
+          "infisical.identity.name": identity.name,
+          "infisical.organization.id": org.id,
+          "infisical.organization.name": org.name,
+          "infisical.identity.auth_method": AuthAttemptAuthMethod.AWS_AUTH,
+          "infisical.identity.auth_result": AuthAttemptAuthResult.SUCCESS,
+          "client.address": requestContext.get("ip"),
+          "user_agent.original": requestContext.get("userAgent")
+        });
+      }
 
-            // Derived from ARN
-            partition: splitArn.Partition,
-            service: splitArn.Service,
-            resourceType: splitArn.Type,
-            resourceName: splitArn.FriendlyName
-          }
-        }
-      } as TIdentityAccessTokenJwtPayload,
-      appCfg.AUTH_SECRET,
-      // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
-      Number(identityAccessToken.accessTokenTTL) === 0
-        ? undefined
-        : {
-            expiresIn: Number(identityAccessToken.accessTokenTTL)
-          }
-    );
-
-    return { accessToken, identityAwsAuth, identityAccessToken, identity };
+      return { accessToken, identityAwsAuth, identityAccessToken, identity };
+    } catch (error) {
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.identity.id": identityAwsAuth.identityId,
+          "infisical.identity.name": identity.name,
+          "infisical.organization.id": org.id,
+          "infisical.organization.name": org.name,
+          "infisical.identity.auth_method": AuthAttemptAuthMethod.AWS_AUTH,
+          "infisical.identity.auth_result": AuthAttemptAuthResult.FAILURE,
+          "client.address": requestContext.get("ip"),
+          "user_agent.original": requestContext.get("userAgent")
+        });
+      }
+      throw error;
+    }
   };
 
   const attachAwsAuth = async ({

backend/src/services/identity-azure-auth/identity-azure-auth-service.ts

@@ -1,4 +1,5 @@
 import { ForbiddenError } from "@casl/ability";
+import { requestContext } from "@fastify/request-context";
 
 import { AccessScope, IdentityAuthMethod, OrganizationActionScope } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
@@ -18,6 +19,7 @@ import {
   UnauthorizedError
 } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
+import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
 import { TIdentityDALFactory } from "../identity/identity-dal";
@@ -61,6 +63,7 @@ export const identityAzureAuthServiceFactory = ({
   orgDAL
 }: TIdentityAzureAuthServiceFactoryDep) => {
   const login = async ({ identityId, jwt: azureJwt }: TLoginAzureAuthDTO) => {
+    const appCfg = getConfig();
     const identityAzureAuth = await identityAzureAuthDAL.findOne({ identityId });
     if (!identityAzureAuth) {
       throw new NotFoundError({ message: "Azure auth method not found for identity, did you configure Azure Auth?" });
@@ -69,69 +72,99 @@ export const identityAzureAuthServiceFactory = ({
     const identity = await identityDAL.findById(identityAzureAuth.identityId);
     if (!identity) throw new UnauthorizedError({ message: "Identity not found" });
 
-    const azureIdentity = await validateAzureIdentity({
-      tenantId: identityAzureAuth.tenantId,
-      resource: identityAzureAuth.resource,
-      jwt: azureJwt
-    });
+    const org = await orgDAL.findById(identity.orgId);
 
-    if (azureIdentity.tid !== identityAzureAuth.tenantId)
-      throw new UnauthorizedError({ message: "Tenant ID mismatch" });
+    try {
+      const azureIdentity = await validateAzureIdentity({
+        tenantId: identityAzureAuth.tenantId,
+        resource: identityAzureAuth.resource,
+        jwt: azureJwt
+      });
 
-    if (identityAzureAuth.allowedServicePrincipalIds) {
-      // validate if the service principal id is in the list of allowed service principal ids
+      if (azureIdentity.tid !== identityAzureAuth.tenantId)
+        throw new UnauthorizedError({ message: "Tenant ID mismatch" });
 
-      const isServicePrincipalAllowed = identityAzureAuth.allowedServicePrincipalIds
-        .split(",")
-        .map((servicePrincipalId) => servicePrincipalId.trim())
-        .some((servicePrincipalId) => servicePrincipalId === azureIdentity.oid);
+      if (identityAzureAuth.allowedServicePrincipalIds) {
+        // validate if the service principal id is in the list of allowed service principal ids
 
-      if (!isServicePrincipalAllowed) {
-        throw new UnauthorizedError({ message: `Service principal '${azureIdentity.oid}' not allowed` });
+        const isServicePrincipalAllowed = identityAzureAuth.allowedServicePrincipalIds
+          .split(",")
+          .map((servicePrincipalId) => servicePrincipalId.trim())
+          .some((servicePrincipalId) => servicePrincipalId === azureIdentity.oid);
+
+        if (!isServicePrincipalAllowed) {
+          throw new UnauthorizedError({ message: `Service principal '${azureIdentity.oid}' not allowed` });
+        }
       }
-    }
 
-    const identityAccessToken = await identityAzureAuthDAL.transaction(async (tx) => {
-      await membershipIdentityDAL.update(
-        { scope: AccessScope.Organization, scopeOrgId: identity.orgId, actorIdentityId: identity.id },
-        {
-          lastLoginAuthMethod: IdentityAuthMethod.AZURE_AUTH,
-          lastLoginTime: new Date()
-        },
-        tx
-      );
-      const newToken = await identityAccessTokenDAL.create(
+      const identityAccessToken = await identityAzureAuthDAL.transaction(async (tx) => {
+        await membershipIdentityDAL.update(
+          { scope: AccessScope.Organization, scopeOrgId: identity.orgId, actorIdentityId: identity.id },
+          {
+            lastLoginAuthMethod: IdentityAuthMethod.AZURE_AUTH,
+            lastLoginTime: new Date()
+          },
+          tx
+        );
+        const newToken = await identityAccessTokenDAL.create(
+          {
+            identityId: identityAzureAuth.identityId,
+            isAccessTokenRevoked: false,
+            accessTokenTTL: identityAzureAuth.accessTokenTTL,
+            accessTokenMaxTTL: identityAzureAuth.accessTokenMaxTTL,
+            accessTokenNumUses: 0,
+            accessTokenNumUsesLimit: identityAzureAuth.accessTokenNumUsesLimit,
+            authMethod: IdentityAuthMethod.AZURE_AUTH
+          },
+          tx
+        );
+        return newToken;
+      });
+
+      const accessToken = crypto.jwt().sign(
         {
           identityId: identityAzureAuth.identityId,
-          isAccessTokenRevoked: false,
-          accessTokenTTL: identityAzureAuth.accessTokenTTL,
-          accessTokenMaxTTL: identityAzureAuth.accessTokenMaxTTL,
-          accessTokenNumUses: 0,
-          accessTokenNumUsesLimit: identityAzureAuth.accessTokenNumUsesLimit,
-          authMethod: IdentityAuthMethod.AZURE_AUTH
-        },
-        tx
+          identityAccessTokenId: identityAccessToken.id,
+          authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
+        } as TIdentityAccessTokenJwtPayload,
+        appCfg.AUTH_SECRET,
+        // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
+        Number(identityAccessToken.accessTokenTTL) === 0
+          ? undefined
+          : {
+              expiresIn: Number(identityAccessToken.accessTokenTTL)
+            }
       );
-      return newToken;
-    });
 
-    const appCfg = getConfig();
-    const accessToken = crypto.jwt().sign(
-      {
-        identityId: identityAzureAuth.identityId,
-        identityAccessTokenId: identityAccessToken.id,
-        authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
-      } as TIdentityAccessTokenJwtPayload,
-      appCfg.AUTH_SECRET,
-      // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
-      Number(identityAccessToken.accessTokenTTL) === 0
-        ? undefined
-        : {
-            expiresIn: Number(identityAccessToken.accessTokenTTL)
-          }
-    );
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.identity.id": identityAzureAuth.identityId,
+          "infisical.identity.name": identity.name,
+          "infisical.organization.id": org.id,
+          "infisical.organization.name": org.name,
+          "infisical.identity.auth_method": AuthAttemptAuthMethod.AZURE_AUTH,
+          "infisical.identity.auth_result": AuthAttemptAuthResult.SUCCESS,
+          "client.address": requestContext.get("ip"),
+          "user_agent.original": requestContext.get("userAgent")
+        });
+      }
 
-    return { accessToken, identityAzureAuth, identityAccessToken, identity };
+      return { accessToken, identityAzureAuth, identityAccessToken, identity };
+    } catch (error) {
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.identity.id": identityAzureAuth.identityId,
+          "infisical.identity.name": identity.name,
+          "infisical.organization.id": org.id,
+          "infisical.organization.name": org.name,
+          "infisical.identity.auth_method": AuthAttemptAuthMethod.AZURE_AUTH,
+          "infisical.identity.auth_result": AuthAttemptAuthResult.FAILURE,
+          "client.address": requestContext.get("ip"),
+          "user_agent.original": requestContext.get("userAgent")
+        });
+      }
+      throw error;
+    }
   };
 
   const attachAzureAuth = async ({

backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts

@@ -1,4 +1,5 @@
 import { ForbiddenError } from "@casl/ability";
+import { requestContext } from "@fastify/request-context";
 
 import { AccessScope, IdentityAuthMethod, OrganizationActionScope } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
@@ -18,6 +19,7 @@ import {
   UnauthorizedError
 } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
+import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
 import { TIdentityDALFactory } from "../identity/identity-dal";
@@ -59,6 +61,7 @@ export const identityGcpAuthServiceFactory = ({
   orgDAL
 }: TIdentityGcpAuthServiceFactoryDep) => {
   const login = async ({ identityId, jwt: gcpJwt }: TLoginGcpAuthDTO) => {
+    const appCfg = getConfig();
     const identityGcpAuth = await identityGcpAuthDAL.findOne({ identityId });
     if (!identityGcpAuth) {
       throw new NotFoundError({ message: "GCP auth method not found for identity, did you configure GCP auth?" });
@@ -67,108 +70,140 @@ export const identityGcpAuthServiceFactory = ({
     const identity = await identityDAL.findById(identityGcpAuth.identityId);
     if (!identity) throw new UnauthorizedError({ message: "Identity not found" });
 
-    let gcpIdentityDetails: TGcpIdentityDetails;
-    switch (identityGcpAuth.type) {
-      case "gce": {
-        gcpIdentityDetails = await validateIdTokenIdentity({
-          identityId,
-          jwt: gcpJwt
-        });
-        break;
+    const org = await orgDAL.findById(identity.orgId);
+    try {
+      let gcpIdentityDetails: TGcpIdentityDetails;
+      switch (identityGcpAuth.type) {
+        case "gce": {
+          gcpIdentityDetails = await validateIdTokenIdentity({
+            identityId,
+            jwt: gcpJwt
+          });
+          break;
+        }
+        case "iam": {
+          gcpIdentityDetails = await validateIamIdentity({
+            identityId,
+            jwt: gcpJwt
+          });
+          break;
+        }
+        default: {
+          throw new BadRequestError({ message: "Invalid GCP Auth type" });
+        }
       }
-      case "iam": {
-        gcpIdentityDetails = await validateIamIdentity({
-          identityId,
-          jwt: gcpJwt
-        });
-        break;
+
+      if (identityGcpAuth.allowedServiceAccounts) {
+        // validate if the service account is in the list of allowed service accounts
+
+        const isServiceAccountAllowed = identityGcpAuth.allowedServiceAccounts
+          .split(",")
+          .map((serviceAccount) => serviceAccount.trim())
+          .some((serviceAccount) => serviceAccount === gcpIdentityDetails.email);
+
+        if (!isServiceAccountAllowed)
+          throw new UnauthorizedError({
+            message: "Access denied: GCP service account not allowed."
+          });
       }
-      default: {
-        throw new BadRequestError({ message: "Invalid GCP Auth type" });
+
+      if (
+        identityGcpAuth.type === "gce" &&
+        identityGcpAuth.allowedProjects &&
+        gcpIdentityDetails.computeEngineDetails
+      ) {
+        // validate if the project that the service account belongs to is in the list of allowed projects
+
+        const isProjectAllowed = identityGcpAuth.allowedProjects
+          .split(",")
+          .map((project) => project.trim())
+          .some((project) => project === gcpIdentityDetails.computeEngineDetails?.project_id);
+
+        if (!isProjectAllowed)
+          throw new UnauthorizedError({
+            message: "Access denied: GCP project not allowed."
+          });
       }
-    }
 
-    if (identityGcpAuth.allowedServiceAccounts) {
-      // validate if the service account is in the list of allowed service accounts
+      if (identityGcpAuth.type === "gce" && identityGcpAuth.allowedZones && gcpIdentityDetails.computeEngineDetails) {
+        const isZoneAllowed = identityGcpAuth.allowedZones
+          .split(",")
+          .map((zone) => zone.trim())
+          .some((zone) => zone === gcpIdentityDetails.computeEngineDetails?.zone);
 
-      const isServiceAccountAllowed = identityGcpAuth.allowedServiceAccounts
-        .split(",")
-        .map((serviceAccount) => serviceAccount.trim())
-        .some((serviceAccount) => serviceAccount === gcpIdentityDetails.email);
+        if (!isZoneAllowed)
+          throw new UnauthorizedError({
+            message: "Access denied: GCP zone not allowed."
+          });
+      }
 
-      if (!isServiceAccountAllowed)
-        throw new UnauthorizedError({
-          message: "Access denied: GCP service account not allowed."
-        });
-    }
-
-    if (identityGcpAuth.type === "gce" && identityGcpAuth.allowedProjects && gcpIdentityDetails.computeEngineDetails) {
-      // validate if the project that the service account belongs to is in the list of allowed projects
-
-      const isProjectAllowed = identityGcpAuth.allowedProjects
-        .split(",")
-        .map((project) => project.trim())
-        .some((project) => project === gcpIdentityDetails.computeEngineDetails?.project_id);
-
-      if (!isProjectAllowed)
-        throw new UnauthorizedError({
-          message: "Access denied: GCP project not allowed."
-        });
-    }
-
-    if (identityGcpAuth.type === "gce" && identityGcpAuth.allowedZones && gcpIdentityDetails.computeEngineDetails) {
-      const isZoneAllowed = identityGcpAuth.allowedZones
-        .split(",")
-        .map((zone) => zone.trim())
-        .some((zone) => zone === gcpIdentityDetails.computeEngineDetails?.zone);
-
-      if (!isZoneAllowed)
-        throw new UnauthorizedError({
-          message: "Access denied: GCP zone not allowed."
-        });
-    }
-
-    const identityAccessToken = await identityGcpAuthDAL.transaction(async (tx) => {
-      await membershipIdentityDAL.update(
-        { scope: AccessScope.Organization, scopeOrgId: identity.orgId, actorIdentityId: identity.id },
-        {
-          lastLoginAuthMethod: IdentityAuthMethod.GCP_AUTH,
-          lastLoginTime: new Date()
-        },
-        tx
-      );
-      const newToken = await identityAccessTokenDAL.create(
+      const identityAccessToken = await identityGcpAuthDAL.transaction(async (tx) => {
+        await membershipIdentityDAL.update(
+          { scope: AccessScope.Organization, scopeOrgId: identity.orgId, actorIdentityId: identity.id },
+          {
+            lastLoginAuthMethod: IdentityAuthMethod.GCP_AUTH,
+            lastLoginTime: new Date()
+          },
+          tx
+        );
+        const newToken = await identityAccessTokenDAL.create(
+          {
+            identityId: identityGcpAuth.identityId,
+            isAccessTokenRevoked: false,
+            accessTokenTTL: identityGcpAuth.accessTokenTTL,
+            accessTokenMaxTTL: identityGcpAuth.accessTokenMaxTTL,
+            accessTokenNumUses: 0,
+            accessTokenNumUsesLimit: identityGcpAuth.accessTokenNumUsesLimit,
+            authMethod: IdentityAuthMethod.GCP_AUTH
+          },
+          tx
+        );
+        return newToken;
+      });
+      const accessToken = crypto.jwt().sign(
         {
           identityId: identityGcpAuth.identityId,
-          isAccessTokenRevoked: false,
-          accessTokenTTL: identityGcpAuth.accessTokenTTL,
-          accessTokenMaxTTL: identityGcpAuth.accessTokenMaxTTL,
-          accessTokenNumUses: 0,
-          accessTokenNumUsesLimit: identityGcpAuth.accessTokenNumUsesLimit,
-          authMethod: IdentityAuthMethod.GCP_AUTH
-        },
-        tx
+          identityAccessTokenId: identityAccessToken.id,
+          authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
+        } as TIdentityAccessTokenJwtPayload,
+        appCfg.AUTH_SECRET,
+        // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
+        Number(identityAccessToken.accessTokenTTL) === 0
+          ? undefined
+          : {
+              expiresIn: Number(identityAccessToken.accessTokenTTL)
+            }
       );
-      return newToken;
-    });
 
-    const appCfg = getConfig();
-    const accessToken = crypto.jwt().sign(
-      {
-        identityId: identityGcpAuth.identityId,
-        identityAccessTokenId: identityAccessToken.id,
-        authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
-      } as TIdentityAccessTokenJwtPayload,
-      appCfg.AUTH_SECRET,
-      // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
-      Number(identityAccessToken.accessTokenTTL) === 0
-        ? undefined
-        : {
-            expiresIn: Number(identityAccessToken.accessTokenTTL)
-          }
-    );
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.identity.id": identityGcpAuth.identityId,
+          "infisical.identity.name": identity.name,
+          "infisical.organization.id": org.id,
+          "infisical.organization.name": org.name,
+          "infisical.identity.auth_method": AuthAttemptAuthMethod.GCP_AUTH,
+          "infisical.identity.auth_result": AuthAttemptAuthResult.SUCCESS,
+          "client.address": requestContext.get("ip"),
+          "user_agent.original": requestContext.get("userAgent")
+        });
+      }
 
-    return { accessToken, identityGcpAuth, identityAccessToken, identity };
+      return { accessToken, identityGcpAuth, identityAccessToken, identity };
+    } catch (error) {
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.identity.id": identityGcpAuth.identityId,
+          "infisical.identity.name": identity.name,
+          "infisical.organization.id": org.id,
+          "infisical.organization.name": org.name,
+          "infisical.identity.auth_method": AuthAttemptAuthMethod.GCP_AUTH,
+          "infisical.identity.auth_result": AuthAttemptAuthResult.FAILURE,
+          "client.address": requestContext.get("ip"),
+          "user_agent.original": requestContext.get("userAgent")
+        });
+      }
+      throw error;
+    }
   };
 
   const attachGcpAuth = async ({

backend/src/services/identity-jwt-auth/identity-jwt-auth-service.ts

@@ -1,4 +1,5 @@
 import { ForbiddenError } from "@casl/ability";
+import { requestContext } from "@fastify/request-context";
 import https from "https";
 import jwt from "jsonwebtoken";
 import { JwksClient } from "jwks-rsa";
@@ -21,6 +22,7 @@ import {
   UnauthorizedError
 } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
+import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 import { getValueByDot } from "@app/lib/template/dot-access";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -67,6 +69,7 @@ export const identityJwtAuthServiceFactory = ({
   orgDAL
 }: TIdentityJwtAuthServiceFactoryDep) => {
   const login = async ({ identityId, jwt: jwtValue }: TLoginJwtAuthDTO) => {
+    const appCfg = getConfig();
     const identityJwtAuth = await identityJwtAuthDAL.findOne({ identityId });
     if (!identityJwtAuth) {
       throw new NotFoundError({ message: "JWT auth method not found for identity, did you configure JWT auth?" });
@@ -75,176 +78,205 @@ export const identityJwtAuthServiceFactory = ({
     const identity = await identityDAL.findById(identityJwtAuth.identityId);
     if (!identity) throw new UnauthorizedError({ message: "Identity not found" });
 
-    const { decryptor: orgDataKeyDecryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.Organization,
-      orgId: identity.orgId
-    });
-
-    const decodedToken = crypto.jwt().decode(jwtValue, { complete: true });
-    if (!decodedToken) {
-      throw new UnauthorizedError({
-        message: "Invalid JWT"
+    const org = await orgDAL.findById(identity.orgId);
+    try {
+      const { decryptor: orgDataKeyDecryptor } = await kmsService.createCipherPairWithDataKey({
+        type: KmsDataKey.Organization,
+        orgId: identity.orgId
       });
-    }
 
-    let tokenData: Record<string, string | boolean | number> = {};
-
-    if (identityJwtAuth.configurationType === JwtConfigurationType.JWKS) {
-      let client: JwksClient;
-      if (identityJwtAuth.jwksUrl.includes("https:")) {
-        const decryptedJwksCaCert = orgDataKeyDecryptor({
-          cipherTextBlob: identityJwtAuth.encryptedJwksCaCert
-        }).toString();
-
-        const requestAgent = new https.Agent({ ca: decryptedJwksCaCert, rejectUnauthorized: !!decryptedJwksCaCert });
-        client = new JwksClient({
-          jwksUri: identityJwtAuth.jwksUrl,
-          requestAgent
-        });
-      } else {
-        client = new JwksClient({
-          jwksUri: identityJwtAuth.jwksUrl
+      const decodedToken = crypto.jwt().decode(jwtValue, { complete: true });
+      if (!decodedToken) {
+        throw new UnauthorizedError({
+          message: "Invalid JWT"
         });
       }
 
-      const { kid } = decodedToken.header as { kid: string };
-      const jwtSigningKey = await client.getSigningKey(kid);
+      let tokenData: Record<string, string | boolean | number> = {};
 
-      try {
-        tokenData = crypto.jwt().verify(jwtValue, jwtSigningKey.getPublicKey()) as Record<string, string>;
-      } catch (error) {
-        if (error instanceof jwt.JsonWebTokenError) {
-          throw new UnauthorizedError({
-            message: `Access denied: ${error.message}`
+      if (identityJwtAuth.configurationType === JwtConfigurationType.JWKS) {
+        let client: JwksClient;
+        if (identityJwtAuth.jwksUrl.includes("https:")) {
+          const decryptedJwksCaCert = orgDataKeyDecryptor({
+            cipherTextBlob: identityJwtAuth.encryptedJwksCaCert
+          }).toString();
+
+          const requestAgent = new https.Agent({ ca: decryptedJwksCaCert, rejectUnauthorized: !!decryptedJwksCaCert });
+          client = new JwksClient({
+            jwksUri: identityJwtAuth.jwksUrl,
+            requestAgent
+          });
+        } else {
+          client = new JwksClient({
+            jwksUri: identityJwtAuth.jwksUrl
           });
         }
 
-        throw error;
-      }
-    } else {
-      const decryptedPublicKeys = orgDataKeyDecryptor({ cipherTextBlob: identityJwtAuth.encryptedPublicKeys })
-        .toString()
-        .split(",");
+        const { kid } = decodedToken.header as { kid: string };
+        const jwtSigningKey = await client.getSigningKey(kid);
 
-      const errors: string[] = [];
-      let isMatchAnyKey = false;
-      for (const publicKey of decryptedPublicKeys) {
         try {
-          tokenData = crypto.jwt().verify(jwtValue, publicKey) as Record<string, string>;
-          isMatchAnyKey = true;
+          tokenData = crypto.jwt().verify(jwtValue, jwtSigningKey.getPublicKey()) as Record<string, string>;
         } catch (error) {
           if (error instanceof jwt.JsonWebTokenError) {
-            errors.push(error.message);
+            throw new UnauthorizedError({
+              message: `Access denied: ${error.message}`
+            });
+          }
+
+          throw error;
+        }
+      } else {
+        const decryptedPublicKeys = orgDataKeyDecryptor({ cipherTextBlob: identityJwtAuth.encryptedPublicKeys })
+          .toString()
+          .split(",");
+
+        const errors: string[] = [];
+        let isMatchAnyKey = false;
+        for (const publicKey of decryptedPublicKeys) {
+          try {
+            tokenData = crypto.jwt().verify(jwtValue, publicKey) as Record<string, string>;
+            isMatchAnyKey = true;
+          } catch (error) {
+            if (error instanceof jwt.JsonWebTokenError) {
+              errors.push(error.message);
+            }
           }
         }
-      }
 
-      if (!isMatchAnyKey) {
-        throw new UnauthorizedError({
-          message: `Access denied: JWT verification failed with all keys. Errors - ${errors.join("; ")}`
-        });
-      }
-    }
-
-    if (identityJwtAuth.boundIssuer) {
-      if (tokenData.iss !== identityJwtAuth.boundIssuer) {
-        throw new ForbiddenRequestError({
-          message: "Access denied: issuer mismatch"
-        });
-      }
-    }
-
-    if (identityJwtAuth.boundSubject) {
-      if (!tokenData.sub) {
-        throw new UnauthorizedError({
-          message: "Access denied: token has no subject field"
-        });
-      }
-
-      if (!doesFieldValueMatchJwtPolicy(tokenData.sub, identityJwtAuth.boundSubject)) {
-        throw new ForbiddenRequestError({
-          message: "Access denied: subject not allowed"
-        });
-      }
-    }
-
-    if (identityJwtAuth.boundAudiences) {
-      if (!tokenData.aud) {
-        throw new UnauthorizedError({
-          message: "Access denied: token has no audience field"
-        });
-      }
-
-      if (
-        !identityJwtAuth.boundAudiences
-          .split(", ")
-          .some((policyValue) => doesFieldValueMatchJwtPolicy(tokenData.aud, policyValue))
-      ) {
-        throw new UnauthorizedError({
-          message: "Access denied: token audience not allowed"
-        });
-      }
-    }
-
-    if (identityJwtAuth.boundClaims) {
-      Object.keys(identityJwtAuth.boundClaims).forEach((claimKey) => {
-        const claimValue = (identityJwtAuth.boundClaims as Record<string, string>)[claimKey];
-        const value = getValueByDot(tokenData, claimKey);
-
-        if (!value) {
+        if (!isMatchAnyKey) {
           throw new UnauthorizedError({
-            message: `Access denied: token has no ${claimKey} field`
+            message: `Access denied: JWT verification failed with all keys. Errors - ${errors.join("; ")}`
+          });
+        }
+      }
+
+      if (identityJwtAuth.boundIssuer) {
+        if (tokenData.iss !== identityJwtAuth.boundIssuer) {
+          throw new ForbiddenRequestError({
+            message: "Access denied: issuer mismatch"
+          });
+        }
+      }
+
+      if (identityJwtAuth.boundSubject) {
+        if (!tokenData.sub) {
+          throw new UnauthorizedError({
+            message: "Access denied: token has no subject field"
           });
         }
 
-        // handle both single and multi-valued claims
-        if (!claimValue.split(", ").some((claimEntry) => doesFieldValueMatchJwtPolicy(value, claimEntry))) {
-          throw new UnauthorizedError({
-            message: `Access denied: claim mismatch for field ${claimKey}`
+        if (!doesFieldValueMatchJwtPolicy(tokenData.sub, identityJwtAuth.boundSubject)) {
+          throw new ForbiddenRequestError({
+            message: "Access denied: subject not allowed"
           });
         }
+      }
+
+      if (identityJwtAuth.boundAudiences) {
+        if (!tokenData.aud) {
+          throw new UnauthorizedError({
+            message: "Access denied: token has no audience field"
+          });
+        }
+
+        if (
+          !identityJwtAuth.boundAudiences
+            .split(", ")
+            .some((policyValue) => doesFieldValueMatchJwtPolicy(tokenData.aud, policyValue))
+        ) {
+          throw new UnauthorizedError({
+            message: "Access denied: token audience not allowed"
+          });
+        }
+      }
+
+      if (identityJwtAuth.boundClaims) {
+        Object.keys(identityJwtAuth.boundClaims).forEach((claimKey) => {
+          const claimValue = (identityJwtAuth.boundClaims as Record<string, string>)[claimKey];
+          const value = getValueByDot(tokenData, claimKey);
+
+          if (!value) {
+            throw new UnauthorizedError({
+              message: `Access denied: token has no ${claimKey} field`
+            });
+          }
+
+          // handle both single and multi-valued claims
+          if (!claimValue.split(", ").some((claimEntry) => doesFieldValueMatchJwtPolicy(value, claimEntry))) {
+            throw new UnauthorizedError({
+              message: `Access denied: claim mismatch for field ${claimKey}`
+            });
+          }
+        });
+      }
+
+      const identityAccessToken = await identityJwtAuthDAL.transaction(async (tx) => {
+        await membershipIdentityDAL.update(
+          { scope: AccessScope.Organization, scopeOrgId: identity.orgId, actorIdentityId: identity.id },
+          { lastLoginAuthMethod: IdentityAuthMethod.JWT_AUTH, lastLoginTime: new Date() },
+          tx
+        );
+        const newToken = await identityAccessTokenDAL.create(
+          {
+            identityId: identityJwtAuth.identityId,
+            isAccessTokenRevoked: false,
+            accessTokenTTL: identityJwtAuth.accessTokenTTL,
+            accessTokenMaxTTL: identityJwtAuth.accessTokenMaxTTL,
+            accessTokenNumUses: 0,
+            accessTokenNumUsesLimit: identityJwtAuth.accessTokenNumUsesLimit,
+            authMethod: IdentityAuthMethod.JWT_AUTH
+          },
+          tx
+        );
+
+        return newToken;
       });
-    }
 
-    const identityAccessToken = await identityJwtAuthDAL.transaction(async (tx) => {
-      await membershipIdentityDAL.update(
-        { scope: AccessScope.Organization, scopeOrgId: identity.orgId, actorIdentityId: identity.id },
-        { lastLoginAuthMethod: IdentityAuthMethod.JWT_AUTH, lastLoginTime: new Date() },
-        tx
-      );
-      const newToken = await identityAccessTokenDAL.create(
+      const accessToken = crypto.jwt().sign(
         {
           identityId: identityJwtAuth.identityId,
-          isAccessTokenRevoked: false,
-          accessTokenTTL: identityJwtAuth.accessTokenTTL,
-          accessTokenMaxTTL: identityJwtAuth.accessTokenMaxTTL,
-          accessTokenNumUses: 0,
-          accessTokenNumUsesLimit: identityJwtAuth.accessTokenNumUsesLimit,
-          authMethod: IdentityAuthMethod.JWT_AUTH
-        },
-        tx
+          identityAccessTokenId: identityAccessToken.id,
+          authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
+        } as TIdentityAccessTokenJwtPayload,
+        appCfg.AUTH_SECRET,
+        // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
+        Number(identityAccessToken.accessTokenTTL) === 0
+          ? undefined
+          : {
+              expiresIn: Number(identityAccessToken.accessTokenTTL)
+            }
       );
 
-      return newToken;
-    });
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.identity.id": identityJwtAuth.identityId,
+          "infisical.identity.name": identity.name,
+          "infisical.organization.id": org.id,
+          "infisical.organization.name": org.name,
+          "infisical.identity.auth_method": AuthAttemptAuthMethod.JWT_AUTH,
+          "infisical.identity.auth_result": AuthAttemptAuthResult.SUCCESS,
+          "client.address": requestContext.get("ip"),
+          "user_agent.original": requestContext.get("userAgent")
+        });
+      }
 
-    const appCfg = getConfig();
-    const accessToken = crypto.jwt().sign(
-      {
-        identityId: identityJwtAuth.identityId,
-        identityAccessTokenId: identityAccessToken.id,
-        authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
-      } as TIdentityAccessTokenJwtPayload,
-      appCfg.AUTH_SECRET,
-      // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
-      Number(identityAccessToken.accessTokenTTL) === 0
-        ? undefined
-        : {
-            expiresIn: Number(identityAccessToken.accessTokenTTL)
-          }
-    );
-
-    return { accessToken, identityJwtAuth, identityAccessToken, identity };
+      return { accessToken, identityJwtAuth, identityAccessToken, identity };
+    } catch (error) {
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.identity.id": identityJwtAuth.identityId,
+          "infisical.identity.name": identity.name,
+          "infisical.organization.id": org.id,
+          "infisical.organization.name": org.name,
+          "infisical.identity.auth_method": AuthAttemptAuthMethod.JWT_AUTH,
+          "infisical.identity.auth_result": AuthAttemptAuthResult.FAILURE,
+          "client.address": requestContext.get("ip"),
+          "user_agent.original": requestContext.get("userAgent")
+        });
+      }
+      throw error;
+    }
   };
 
   const attachJwtAuth = async ({

backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts

@@ -1,4 +1,5 @@
 import { ForbiddenError } from "@casl/ability";
+import { requestContext } from "@fastify/request-context";
 import axios, { AxiosError } from "axios";
 import https from "https";
 import RE2 from "re2";
@@ -37,6 +38,7 @@ import { GatewayHttpProxyActions, GatewayProxyProtocol, withGatewayProxy } from
 import { withGatewayV2Proxy } from "@app/lib/gateway-v2/gateway-v2";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 import { logger } from "@app/lib/logger";
+import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
 import { TIdentityDALFactory } from "../identity/identity-dal";
@@ -182,6 +184,7 @@ export const identityKubernetesAuthServiceFactory = ({
   };
 
   const login = async ({ identityId, jwt: serviceAccountJwt }: TLoginKubernetesAuthDTO) => {
+    const appCfg = getConfig();
     const identityKubernetesAuth = await identityKubernetesAuthDAL.findOne({ identityId });
     if (!identityKubernetesAuth) {
       throw new NotFoundError({
@@ -192,294 +195,328 @@ export const identityKubernetesAuthServiceFactory = ({
     const identity = await identityDAL.findById(identityKubernetesAuth.identityId);
     if (!identity) throw new UnauthorizedError({ message: "Identity not found" });
 
-    const { decryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.Organization,
-      orgId: identity.orgId
-    });
+    const org = await orgDAL.findById(identity.orgId);
 
-    let caCert = "";
-    if (identityKubernetesAuth.encryptedKubernetesCaCertificate) {
-      caCert = decryptor({ cipherTextBlob: identityKubernetesAuth.encryptedKubernetesCaCertificate }).toString();
-    }
+    try {
+      const { decryptor } = await kmsService.createCipherPairWithDataKey({
+        type: KmsDataKey.Organization,
+        orgId: identity.orgId
+      });
 
-    const tokenReviewCallbackRaw = async (host = identityKubernetesAuth.kubernetesHost, port?: number) => {
-      logger.info({ host, port }, "tokenReviewCallbackRaw: Processing kubernetes token review using raw API");
-
-      if (!host || !identityKubernetesAuth.kubernetesHost) {
-        throw new BadRequestError({
-          message: "Kubernetes host is required when token review mode is set to API"
-        });
+      let caCert = "";
+      if (identityKubernetesAuth.encryptedKubernetesCaCertificate) {
+        caCert = decryptor({ cipherTextBlob: identityKubernetesAuth.encryptedKubernetesCaCertificate }).toString();
       }
 
-      let tokenReviewerJwt = "";
-      if (identityKubernetesAuth.encryptedKubernetesTokenReviewerJwt) {
-        tokenReviewerJwt = decryptor({
-          cipherTextBlob: identityKubernetesAuth.encryptedKubernetesTokenReviewerJwt
-        }).toString();
-      } else {
-        // if no token reviewer is provided means the incoming token has to act as reviewer
-        tokenReviewerJwt = serviceAccountJwt;
-      }
+      const tokenReviewCallbackRaw = async (host = identityKubernetesAuth.kubernetesHost, port?: number) => {
+        logger.info({ host, port }, "tokenReviewCallbackRaw: Processing kubernetes token review using raw API");
 
-      let servername = identityKubernetesAuth.kubernetesHost;
-      if (servername.startsWith("https://") || servername.startsWith("http://")) {
-        servername = new RE2("^https?:\\/\\/").replace(servername, "");
-      }
+        if (!host || !identityKubernetesAuth.kubernetesHost) {
+          throw new BadRequestError({
+            message: "Kubernetes host is required when token review mode is set to API"
+          });
+        }
 
-      // get the last colon index, if it has a port, remove it, including the colon
-      const lastColonIndex = servername.lastIndexOf(":");
-      if (lastColonIndex !== -1) {
-        servername = servername.substring(0, lastColonIndex);
-      }
+        let tokenReviewerJwt = "";
+        if (identityKubernetesAuth.encryptedKubernetesTokenReviewerJwt) {
+          tokenReviewerJwt = decryptor({
+            cipherTextBlob: identityKubernetesAuth.encryptedKubernetesTokenReviewerJwt
+          }).toString();
+        } else {
+          // if no token reviewer is provided means the incoming token has to act as reviewer
+          tokenReviewerJwt = serviceAccountJwt;
+        }
 
-      const baseUrl = port ? `${host}:${port}` : host;
+        let servername = identityKubernetesAuth.kubernetesHost;
+        if (servername.startsWith("https://") || servername.startsWith("http://")) {
+          servername = new RE2("^https?:\\/\\/").replace(servername, "");
+        }
 
-      const res = await axios
-        .post<TCreateTokenReviewResponse>(
-          `${baseUrl}/apis/authentication.k8s.io/v1/tokenreviews`,
-          {
-            apiVersion: "authentication.k8s.io/v1",
-            kind: "TokenReview",
-            spec: {
-              token: serviceAccountJwt,
-              ...(identityKubernetesAuth.allowedAudience ? { audiences: [identityKubernetesAuth.allowedAudience] } : {})
-            }
-          },
-          {
-            headers: {
-              "Content-Type": "application/json",
-              Authorization: `Bearer ${tokenReviewerJwt}`
+        // get the last colon index, if it has a port, remove it, including the colon
+        const lastColonIndex = servername.lastIndexOf(":");
+        if (lastColonIndex !== -1) {
+          servername = servername.substring(0, lastColonIndex);
+        }
+
+        const baseUrl = port ? `${host}:${port}` : host;
+
+        const res = await axios
+          .post<TCreateTokenReviewResponse>(
+            `${baseUrl}/apis/authentication.k8s.io/v1/tokenreviews`,
+            {
+              apiVersion: "authentication.k8s.io/v1",
+              kind: "TokenReview",
+              spec: {
+                token: serviceAccountJwt,
+                ...(identityKubernetesAuth.allowedAudience
+                  ? { audiences: [identityKubernetesAuth.allowedAudience] }
+                  : {})
+              }
             },
-            signal: AbortSignal.timeout(10000),
-            timeout: 10000,
-            httpsAgent: new https.Agent({
-              ca: caCert,
-              rejectUnauthorized: Boolean(caCert),
-              servername
-            })
-          }
-        )
-        .catch((err) => {
-          if (err instanceof AxiosError) {
-            if (err.response) {
-              const { message } = err?.response?.data as unknown as { message?: string };
-
-              if (message) {
-                throw new UnauthorizedError({
-                  message,
-                  name: "KubernetesTokenReviewRequestError"
-                });
-              }
-            }
-          }
-          throw err;
-        });
-
-      return res.data;
-    };
-
-    const tokenReviewCallbackThroughGateway = async (host: string, port?: number) => {
-      logger.info(
-        {
-          host,
-          port
-        },
-        "tokenReviewCallbackThroughGateway: Processing kubernetes token review using gateway"
-      );
-
-      const res = await axios
-        .post<TCreateTokenReviewResponse>(
-          `${host}:${port}/apis/authentication.k8s.io/v1/tokenreviews`,
-          {
-            apiVersion: "authentication.k8s.io/v1",
-            kind: "TokenReview",
-            spec: {
-              token: serviceAccountJwt,
-              ...(identityKubernetesAuth.allowedAudience ? { audiences: [identityKubernetesAuth.allowedAudience] } : {})
-            }
-          },
-          {
-            headers: {
-              "Content-Type": "application/json",
-              "x-infisical-action": GatewayHttpProxyActions.UseGatewayK8sServiceAccount
-            },
-            signal: AbortSignal.timeout(10000),
-            timeout: 10000
-          }
-        )
-        .catch((err) => {
-          if (err instanceof AxiosError) {
-            if (err.response) {
-              let { message } = err?.response?.data as unknown as { message?: string };
-
-              if (!message && typeof err.response.data === "string") {
-                message = err.response.data;
-              }
-
-              if (message) {
-                throw new UnauthorizedError({
-                  message,
-                  name: "KubernetesTokenReviewRequestError"
-                });
-              }
-            }
-          }
-          throw err;
-        });
-
-      return res.data;
-    };
-
-    let data: TCreateTokenReviewResponse | undefined;
-
-    if (identityKubernetesAuth.tokenReviewMode === IdentityKubernetesAuthTokenReviewMode.Gateway) {
-      if (!identityKubernetesAuth.gatewayId && !identityKubernetesAuth.gatewayV2Id) {
-        throw new BadRequestError({
-          message: "Gateway ID is required when token review mode is set to Gateway"
-        });
-      }
-
-      data = await $gatewayProxyWrapper(
-        {
-          gatewayId: (identityKubernetesAuth.gatewayV2Id ?? identityKubernetesAuth.gatewayId) as string,
-          reviewTokenThroughGateway: true
-        },
-        tokenReviewCallbackThroughGateway
-      );
-    } else if (identityKubernetesAuth.tokenReviewMode === IdentityKubernetesAuthTokenReviewMode.Api) {
-      if (!identityKubernetesAuth.kubernetesHost) {
-        throw new BadRequestError({
-          message: "Kubernetes host is required when token review mode is set to API"
-        });
-      }
-
-      let { kubernetesHost } = identityKubernetesAuth;
-      if (kubernetesHost.startsWith("https://") || kubernetesHost.startsWith("http://")) {
-        kubernetesHost = new RE2("^https?:\\/\\/").replace(kubernetesHost, "");
-      }
-
-      const [k8sHost, k8sPort] = kubernetesHost.split(":");
-
-      data =
-        identityKubernetesAuth.gatewayId || identityKubernetesAuth.gatewayV2Id
-          ? await $gatewayProxyWrapper(
-              {
-                gatewayId: (identityKubernetesAuth.gatewayV2Id ?? identityKubernetesAuth.gatewayId) as string,
-                targetHost: k8sHost,
-                targetPort: k8sPort ? Number(k8sPort) : 443,
-                reviewTokenThroughGateway: false
+            {
+              headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${tokenReviewerJwt}`
               },
-              tokenReviewCallbackRaw
-            )
-          : await tokenReviewCallbackRaw();
-    } else {
-      throw new BadRequestError({
-        message: `Invalid token review mode: ${identityKubernetesAuth.tokenReviewMode}`
-      });
-    }
+              signal: AbortSignal.timeout(10000),
+              timeout: 10000,
+              httpsAgent: new https.Agent({
+                ca: caCert,
+                rejectUnauthorized: Boolean(caCert),
+                servername
+              })
+            }
+          )
+          .catch((err) => {
+            if (err instanceof AxiosError) {
+              if (err.response) {
+                const { message } = err?.response?.data as unknown as { message?: string };
 
-    if (!data) {
-      throw new BadRequestError({
-        message: "Failed to review token"
-      });
-    }
+                if (message) {
+                  throw new UnauthorizedError({
+                    message,
+                    name: "KubernetesTokenReviewRequestError"
+                  });
+                }
+              }
+            }
+            throw err;
+          });
 
-    if ("error" in data.status)
-      throw new UnauthorizedError({ message: data.status.error, name: "KubernetesTokenReviewError" });
+        return res.data;
+      };
 
-    // check the response to determine if the token is valid
-    if (!(data.status && data.status.authenticated))
-      throw new UnauthorizedError({
-        message: "Kubernetes token not authenticated",
-        name: "KubernetesTokenReviewError"
+      const tokenReviewCallbackThroughGateway = async (host: string, port?: number) => {
+        logger.info(
+          {
+            host,
+            port
+          },
+          "tokenReviewCallbackThroughGateway: Processing kubernetes token review using gateway"
+        );
+
+        const res = await axios
+          .post<TCreateTokenReviewResponse>(
+            `${host}:${port}/apis/authentication.k8s.io/v1/tokenreviews`,
+            {
+              apiVersion: "authentication.k8s.io/v1",
+              kind: "TokenReview",
+              spec: {
+                token: serviceAccountJwt,
+                ...(identityKubernetesAuth.allowedAudience
+                  ? { audiences: [identityKubernetesAuth.allowedAudience] }
+                  : {})
+              }
+            },
+            {
+              headers: {
+                "Content-Type": "application/json",
+                "x-infisical-action": GatewayHttpProxyActions.UseGatewayK8sServiceAccount
+              },
+              signal: AbortSignal.timeout(10000),
+              timeout: 10000
+            }
+          )
+          .catch((err) => {
+            if (err instanceof AxiosError) {
+              if (err.response) {
+                let { message } = err?.response?.data as unknown as { message?: string };
+
+                if (!message && typeof err.response.data === "string") {
+                  message = err.response.data;
+                }
+
+                if (message) {
+                  throw new UnauthorizedError({
+                    message,
+                    name: "KubernetesTokenReviewRequestError"
+                  });
+                }
+              }
+            }
+            throw err;
+          });
+
+        return res.data;
+      };
+
+      let data: TCreateTokenReviewResponse | undefined;
+
+      if (identityKubernetesAuth.tokenReviewMode === IdentityKubernetesAuthTokenReviewMode.Gateway) {
+        if (!identityKubernetesAuth.gatewayId && !identityKubernetesAuth.gatewayV2Id) {
+          throw new BadRequestError({
+            message: "Gateway ID is required when token review mode is set to Gateway"
+          });
+        }
+
+        data = await $gatewayProxyWrapper(
+          {
+            gatewayId: (identityKubernetesAuth.gatewayV2Id ?? identityKubernetesAuth.gatewayId) as string,
+            reviewTokenThroughGateway: true
+          },
+          tokenReviewCallbackThroughGateway
+        );
+      } else if (identityKubernetesAuth.tokenReviewMode === IdentityKubernetesAuthTokenReviewMode.Api) {
+        if (!identityKubernetesAuth.kubernetesHost) {
+          throw new BadRequestError({
+            message: "Kubernetes host is required when token review mode is set to API"
+          });
+        }
+
+        let { kubernetesHost } = identityKubernetesAuth;
+        if (kubernetesHost.startsWith("https://") || kubernetesHost.startsWith("http://")) {
+          kubernetesHost = new RE2("^https?:\\/\\/").replace(kubernetesHost, "");
+        }
+
+        const [k8sHost, k8sPort] = kubernetesHost.split(":");
+
+        data =
+          identityKubernetesAuth.gatewayId || identityKubernetesAuth.gatewayV2Id
+            ? await $gatewayProxyWrapper(
+                {
+                  gatewayId: (identityKubernetesAuth.gatewayV2Id ?? identityKubernetesAuth.gatewayId) as string,
+                  targetHost: k8sHost,
+                  targetPort: k8sPort ? Number(k8sPort) : 443,
+                  reviewTokenThroughGateway: false
+                },
+                tokenReviewCallbackRaw
+              )
+            : await tokenReviewCallbackRaw();
+      } else {
+        throw new BadRequestError({
+          message: `Invalid token review mode: ${identityKubernetesAuth.tokenReviewMode}`
+        });
+      }
+
+      if (!data) {
+        throw new BadRequestError({
+          message: "Failed to review token"
+        });
+      }
+
+      if ("error" in data.status)
+        throw new UnauthorizedError({ message: data.status.error, name: "KubernetesTokenReviewError" });
+
+      // check the response to determine if the token is valid
+      if (!(data.status && data.status.authenticated))
+        throw new UnauthorizedError({
+          message: "Kubernetes token not authenticated",
+          name: "KubernetesTokenReviewError"
+        });
+
+      const { namespace: targetNamespace, name: targetName } = extractK8sUsername(data.status.user.username);
+
+      if (identityKubernetesAuth.allowedNamespaces) {
+        // validate if [targetNamespace] is in the list of allowed namespaces
+
+        const isNamespaceAllowed = identityKubernetesAuth.allowedNamespaces
+          .split(",")
+          .map((namespace) => namespace.trim())
+          .some((namespace) => namespace === targetNamespace);
+
+        if (!isNamespaceAllowed)
+          throw new UnauthorizedError({
+            message: "Access denied: K8s namespace not allowed."
+          });
+      }
+
+      if (identityKubernetesAuth.allowedNames) {
+        // validate if [targetName] is in the list of allowed names
+
+        const isNameAllowed = identityKubernetesAuth.allowedNames
+          .split(",")
+          .map((name) => name.trim())
+          .some((name) => name === targetName);
+
+        if (!isNameAllowed)
+          throw new UnauthorizedError({
+            message: "Access denied: K8s name not allowed."
+          });
+      }
+
+      if (identityKubernetesAuth.allowedAudience) {
+        // validate if [audience] is in the list of allowed audiences
+        const isAudienceAllowed = data.status.audiences.some(
+          (audience) => audience === identityKubernetesAuth.allowedAudience
+        );
+
+        if (!isAudienceAllowed)
+          throw new UnauthorizedError({
+            message: "Access denied: K8s audience not allowed."
+          });
+      }
+
+      const identityAccessToken = await identityKubernetesAuthDAL.transaction(async (tx) => {
+        await membershipIdentityDAL.update(
+          { scope: AccessScope.Organization, scopeOrgId: identity.orgId, actorIdentityId: identity.id },
+          { lastLoginAuthMethod: IdentityAuthMethod.KUBERNETES_AUTH, lastLoginTime: new Date() },
+          tx
+        );
+        const newToken = await identityAccessTokenDAL.create(
+          {
+            identityId: identityKubernetesAuth.identityId,
+            isAccessTokenRevoked: false,
+            accessTokenTTL: identityKubernetesAuth.accessTokenTTL,
+            accessTokenMaxTTL: identityKubernetesAuth.accessTokenMaxTTL,
+            accessTokenNumUses: 0,
+            accessTokenNumUsesLimit: identityKubernetesAuth.accessTokenNumUsesLimit,
+            authMethod: IdentityAuthMethod.KUBERNETES_AUTH
+          },
+          tx
+        );
+        return newToken;
       });
 
-    const { namespace: targetNamespace, name: targetName } = extractK8sUsername(data.status.user.username);
-
-    if (identityKubernetesAuth.allowedNamespaces) {
-      // validate if [targetNamespace] is in the list of allowed namespaces
-
-      const isNamespaceAllowed = identityKubernetesAuth.allowedNamespaces
-        .split(",")
-        .map((namespace) => namespace.trim())
-        .some((namespace) => namespace === targetNamespace);
-
-      if (!isNamespaceAllowed)
-        throw new UnauthorizedError({
-          message: "Access denied: K8s namespace not allowed."
-        });
-    }
-
-    if (identityKubernetesAuth.allowedNames) {
-      // validate if [targetName] is in the list of allowed names
-
-      const isNameAllowed = identityKubernetesAuth.allowedNames
-        .split(",")
-        .map((name) => name.trim())
-        .some((name) => name === targetName);
-
-      if (!isNameAllowed)
-        throw new UnauthorizedError({
-          message: "Access denied: K8s name not allowed."
-        });
-    }
-
-    if (identityKubernetesAuth.allowedAudience) {
-      // validate if [audience] is in the list of allowed audiences
-      const isAudienceAllowed = data.status.audiences.some(
-        (audience) => audience === identityKubernetesAuth.allowedAudience
-      );
-
-      if (!isAudienceAllowed)
-        throw new UnauthorizedError({
-          message: "Access denied: K8s audience not allowed."
-        });
-    }
-
-    const identityAccessToken = await identityKubernetesAuthDAL.transaction(async (tx) => {
-      await membershipIdentityDAL.update(
-        { scope: AccessScope.Organization, scopeOrgId: identity.orgId, actorIdentityId: identity.id },
-        { lastLoginAuthMethod: IdentityAuthMethod.KUBERNETES_AUTH, lastLoginTime: new Date() },
-        tx
-      );
-      const newToken = await identityAccessTokenDAL.create(
+      const accessToken = crypto.jwt().sign(
         {
           identityId: identityKubernetesAuth.identityId,
-          isAccessTokenRevoked: false,
-          accessTokenTTL: identityKubernetesAuth.accessTokenTTL,
-          accessTokenMaxTTL: identityKubernetesAuth.accessTokenMaxTTL,
-          accessTokenNumUses: 0,
-          accessTokenNumUsesLimit: identityKubernetesAuth.accessTokenNumUsesLimit,
-          authMethod: IdentityAuthMethod.KUBERNETES_AUTH
-        },
-        tx
+          identityAccessTokenId: identityAccessToken.id,
+          authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN,
+          identityAuth: {
+            kubernetes: {
+              namespace: targetNamespace,
+              name: targetName
+            }
+          }
+        } as TIdentityAccessTokenJwtPayload,
+        appCfg.AUTH_SECRET,
+        // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
+        Number(identityAccessToken.accessTokenTTL) === 0
+          ? undefined
+          : {
+              expiresIn: Number(identityAccessToken.accessTokenTTL)
+            }
       );
-      return newToken;
-    });
 
-    const appCfg = getConfig();
-    const accessToken = crypto.jwt().sign(
-      {
-        identityId: identityKubernetesAuth.identityId,
-        identityAccessTokenId: identityAccessToken.id,
-        authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN,
-        identityAuth: {
-          kubernetes: {
-            namespace: targetNamespace,
-            name: targetName
-          }
-        }
-      } as TIdentityAccessTokenJwtPayload,
-      appCfg.AUTH_SECRET,
-      // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
-      Number(identityAccessToken.accessTokenTTL) === 0
-        ? undefined
-        : {
-            expiresIn: Number(identityAccessToken.accessTokenTTL)
-          }
-    );
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.identity.id": identityKubernetesAuth.identityId,
+          "infisical.identity.name": identity.name,
+          "infisical.organization.id": org.id,
+          "infisical.organization.name": org.name,
+          "infisical.identity.auth_method": AuthAttemptAuthMethod.KUBERNETES_AUTH,
+          "infisical.identity.auth_result": AuthAttemptAuthResult.SUCCESS,
+          "client.address": requestContext.get("ip"),
+          "user_agent.original": requestContext.get("userAgent")
+        });
+      }
 
-    return { accessToken, identityKubernetesAuth, identityAccessToken, identity };
+      return { accessToken, identityKubernetesAuth, identityAccessToken, identity };
+    } catch (error) {
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.identity.id": identityKubernetesAuth.identityId,
+          "infisical.identity.name": identity.name,
+          "infisical.organization.id": org.id,
+          "infisical.organization.name": org.name,
+          "infisical.identity.auth_method": AuthAttemptAuthMethod.KUBERNETES_AUTH,
+          "infisical.identity.auth_result": AuthAttemptAuthResult.FAILURE,
+          "client.address": requestContext.get("ip"),
+          "user_agent.original": requestContext.get("userAgent")
+        });
+      }
+      throw error;
+    }
   };
 
   const attachKubernetesAuth = async ({

backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts

@@ -1,5 +1,6 @@
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
 import { ForbiddenError } from "@casl/ability";
+import { requestContext } from "@fastify/request-context";
 import slugify from "@sindresorhus/slugify";
 
 import { AccessScope, IdentityAuthMethod, OrganizationActionScope } from "@app/db/schemas";
@@ -29,6 +30,7 @@ import {
 } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 import { logger } from "@app/lib/logger";
+import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
 import { TIdentityDALFactory } from "../identity/identity-dal";
@@ -151,6 +153,7 @@ export const identityLdapAuthServiceFactory = ({
   };
 
   const login = async ({ identityId }: TLoginLdapAuthDTO) => {
+    const appCfg = getConfig();
     const identityLdapAuth = await identityLdapAuthDAL.findOne({ identityId });
 
     if (!identityLdapAuth) {
@@ -162,6 +165,7 @@ export const identityLdapAuthServiceFactory = ({
     const identity = await identityDAL.findById(identityLdapAuth.identityId);
     if (!identity) throw new UnauthorizedError({ message: "Identity not found" });
 
+    const org = await orgDAL.findById(identity.orgId);
     const plan = await licenseService.getPlan(identity.orgId);
     if (!plan.ldap) {
       throw new BadRequestError({
@@ -170,44 +174,72 @@ export const identityLdapAuthServiceFactory = ({
       });
     }
 
-    const identityAccessToken = await identityLdapAuthDAL.transaction(async (tx) => {
-      await membershipIdentityDAL.update(
-        { scope: AccessScope.Organization, scopeOrgId: identity.orgId, actorIdentityId: identity.id },
-        { lastLoginAuthMethod: IdentityAuthMethod.LDAP_AUTH, lastLoginTime: new Date() },
-        tx
-      );
-      const newToken = await identityAccessTokenDAL.create(
+    try {
+      const identityAccessToken = await identityLdapAuthDAL.transaction(async (tx) => {
+        await membershipIdentityDAL.update(
+          { scope: AccessScope.Organization, scopeOrgId: identity.orgId, actorIdentityId: identity.id },
+          { lastLoginAuthMethod: IdentityAuthMethod.LDAP_AUTH, lastLoginTime: new Date() },
+          tx
+        );
+        const newToken = await identityAccessTokenDAL.create(
+          {
+            identityId: identityLdapAuth.identityId,
+            isAccessTokenRevoked: false,
+            accessTokenTTL: identityLdapAuth.accessTokenTTL,
+            accessTokenMaxTTL: identityLdapAuth.accessTokenMaxTTL,
+            accessTokenNumUses: 0,
+            accessTokenNumUsesLimit: identityLdapAuth.accessTokenNumUsesLimit,
+            authMethod: IdentityAuthMethod.LDAP_AUTH
+          },
+          tx
+        );
+        return newToken;
+      });
+
+      const accessToken = crypto.jwt().sign(
         {
           identityId: identityLdapAuth.identityId,
-          isAccessTokenRevoked: false,
-          accessTokenTTL: identityLdapAuth.accessTokenTTL,
-          accessTokenMaxTTL: identityLdapAuth.accessTokenMaxTTL,
-          accessTokenNumUses: 0,
-          accessTokenNumUsesLimit: identityLdapAuth.accessTokenNumUsesLimit,
-          authMethod: IdentityAuthMethod.LDAP_AUTH
-        },
-        tx
+          identityAccessTokenId: identityAccessToken.id,
+          authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
+        } as TIdentityAccessTokenJwtPayload,
+        appCfg.AUTH_SECRET,
+        // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
+        Number(identityAccessToken.accessTokenTTL) === 0
+          ? undefined
+          : {
+              expiresIn: Number(identityAccessToken.accessTokenTTL)
+            }
       );
-      return newToken;
-    });
 
-    const appCfg = getConfig();
-    const accessToken = crypto.jwt().sign(
-      {
-        identityId: identityLdapAuth.identityId,
-        identityAccessTokenId: identityAccessToken.id,
-        authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
-      } as TIdentityAccessTokenJwtPayload,
-      appCfg.AUTH_SECRET,
-      // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
-      Number(identityAccessToken.accessTokenTTL) === 0
-        ? undefined
-        : {
-            expiresIn: Number(identityAccessToken.accessTokenTTL)
-          }
-    );
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.identity.id": identityLdapAuth.identityId,
+          "infisical.identity.name": identity.name,
+          "infisical.organization.id": org.id,
+          "infisical.organization.name": org.name,
+          "infisical.identity.auth_method": AuthAttemptAuthMethod.LDAP_AUTH,
+          "infisical.identity.auth_result": AuthAttemptAuthResult.SUCCESS,
+          "client.address": requestContext.get("ip"),
+          "user_agent.original": requestContext.get("userAgent")
+        });
+      }
 
-    return { accessToken, identityLdapAuth, identityAccessToken, identity };
+      return { accessToken, identityLdapAuth, identityAccessToken, identity };
+    } catch (error) {
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.identity.id": identityLdapAuth.identityId,
+          "infisical.identity.name": identity.name,
+          "infisical.organization.id": org.id,
+          "infisical.organization.name": org.name,
+          "infisical.identity.auth_method": AuthAttemptAuthMethod.LDAP_AUTH,
+          "infisical.identity.auth_result": AuthAttemptAuthResult.FAILURE,
+          "client.address": requestContext.get("ip"),
+          "user_agent.original": requestContext.get("userAgent")
+        });
+      }
+      throw error;
+    }
   };
 
   const attachLdapAuth = async ({

backend/src/services/identity-oci-auth/identity-oci-auth-service.ts

@@ -1,5 +1,6 @@
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
 import { ForbiddenError } from "@casl/ability";
+import { requestContext } from "@fastify/request-context";
 import { AxiosError } from "axios";
 import RE2 from "re2";
 
@@ -23,6 +24,7 @@ import {
 } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 import { logger } from "@app/lib/logger";
+import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
 import { TIdentityDALFactory } from "../identity/identity-dal";
@@ -63,6 +65,7 @@ export const identityOciAuthServiceFactory = ({
   orgDAL
 }: TIdentityOciAuthServiceFactoryDep) => {
   const login = async ({ identityId, headers, userOcid }: TLoginOciAuthDTO) => {
+    const appCfg = getConfig();
     const identityOciAuth = await identityOciAuthDAL.findOne({ identityId });
     if (!identityOciAuth) {
       throw new NotFoundError({ message: "OCI auth method not found for identity, did you configure OCI auth?" });
@@ -71,80 +74,109 @@ export const identityOciAuthServiceFactory = ({
     const identity = await identityDAL.findById(identityOciAuth.identityId);
     if (!identity) throw new UnauthorizedError({ message: "Identity not found" });
 
-    // Validate OCI host format. Ensures that the host is in "identity.<region>.oraclecloud.com" format.
-    if (!headers.host || !new RE2("^identity\\.([a-z]{2}-[a-z]+-[1-9])\\.oraclecloud\\.com$").test(headers.host)) {
-      throw new BadRequestError({
-        message: "Invalid OCI host format. Expected format: identity.<region>.oraclecloud.com"
-      });
-    }
-
-    const { data } = await request
-      .get<TOciGetUserResponse>(`https://${headers.host}/20160918/users/${userOcid}`, {
-        headers
-      })
-      .catch((err: AxiosError) => {
-        logger.error(err.response, "OciIdentityLogin: Failed to authenticate with Oracle Cloud");
-        throw err;
-      });
-
-    if (data.compartmentId !== identityOciAuth.tenancyOcid) {
-      throw new UnauthorizedError({
-        message: "Access denied: OCI account isn't part of tenancy."
-      });
-    }
-
-    if (identityOciAuth.allowedUsernames) {
-      const isAccountAllowed = identityOciAuth.allowedUsernames.split(",").some((name) => name.trim() === data.name);
-
-      if (!isAccountAllowed)
-        throw new UnauthorizedError({
-          message: "Access denied: OCI account username not allowed."
+    const org = await orgDAL.findById(identity.orgId);
+    try {
+      // Validate OCI host format. Ensures that the host is in "identity.<region>.oraclecloud.com" format.
+      if (!headers.host || !new RE2("^identity\\.([a-z]{2}-[a-z]+-[1-9])\\.oraclecloud\\.com$").test(headers.host)) {
+        throw new BadRequestError({
+          message: "Invalid OCI host format. Expected format: identity.<region>.oraclecloud.com"
         });
-    }
+      }
 
-    // Generate the token
-    const identityAccessToken = await identityOciAuthDAL.transaction(async (tx) => {
-      await membershipIdentityDAL.update(
-        { scope: AccessScope.Organization, scopeOrgId: identity.orgId, actorIdentityId: identity.id },
-        { lastLoginAuthMethod: IdentityAuthMethod.OCI_AUTH, lastLoginTime: new Date() },
-        tx
-      );
-      const newToken = await identityAccessTokenDAL.create(
+      const { data } = await request
+        .get<TOciGetUserResponse>(`https://${headers.host}/20160918/users/${userOcid}`, {
+          headers
+        })
+        .catch((err: AxiosError) => {
+          logger.error(err.response, "OciIdentityLogin: Failed to authenticate with Oracle Cloud");
+          throw err;
+        });
+
+      if (data.compartmentId !== identityOciAuth.tenancyOcid) {
+        throw new UnauthorizedError({
+          message: "Access denied: OCI account isn't part of tenancy."
+        });
+      }
+
+      if (identityOciAuth.allowedUsernames) {
+        const isAccountAllowed = identityOciAuth.allowedUsernames.split(",").some((name) => name.trim() === data.name);
+
+        if (!isAccountAllowed)
+          throw new UnauthorizedError({
+            message: "Access denied: OCI account username not allowed."
+          });
+      }
+
+      // Generate the token
+      const identityAccessToken = await identityOciAuthDAL.transaction(async (tx) => {
+        await membershipIdentityDAL.update(
+          { scope: AccessScope.Organization, scopeOrgId: identity.orgId, actorIdentityId: identity.id },
+          { lastLoginAuthMethod: IdentityAuthMethod.OCI_AUTH, lastLoginTime: new Date() },
+          tx
+        );
+        const newToken = await identityAccessTokenDAL.create(
+          {
+            identityId: identityOciAuth.identityId,
+            isAccessTokenRevoked: false,
+            accessTokenTTL: identityOciAuth.accessTokenTTL,
+            accessTokenMaxTTL: identityOciAuth.accessTokenMaxTTL,
+            accessTokenNumUses: 0,
+            accessTokenNumUsesLimit: identityOciAuth.accessTokenNumUsesLimit,
+            authMethod: IdentityAuthMethod.OCI_AUTH
+          },
+          tx
+        );
+        return newToken;
+      });
+
+      const accessToken = crypto.jwt().sign(
         {
           identityId: identityOciAuth.identityId,
-          isAccessTokenRevoked: false,
-          accessTokenTTL: identityOciAuth.accessTokenTTL,
-          accessTokenMaxTTL: identityOciAuth.accessTokenMaxTTL,
-          accessTokenNumUses: 0,
-          accessTokenNumUsesLimit: identityOciAuth.accessTokenNumUsesLimit,
-          authMethod: IdentityAuthMethod.OCI_AUTH
-        },
-        tx
+          identityAccessTokenId: identityAccessToken.id,
+          authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
+        } as TIdentityAccessTokenJwtPayload,
+        appCfg.AUTH_SECRET,
+        Number(identityAccessToken.accessTokenTTL) === 0
+          ? undefined
+          : {
+              expiresIn: Number(identityAccessToken.accessTokenTTL)
+            }
       );
-      return newToken;
-    });
 
-    const appCfg = getConfig();
-    const accessToken = crypto.jwt().sign(
-      {
-        identityId: identityOciAuth.identityId,
-        identityAccessTokenId: identityAccessToken.id,
-        authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
-      } as TIdentityAccessTokenJwtPayload,
-      appCfg.AUTH_SECRET,
-      Number(identityAccessToken.accessTokenTTL) === 0
-        ? undefined
-        : {
-            expiresIn: Number(identityAccessToken.accessTokenTTL)
-          }
-    );
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.identity.id": identityOciAuth.identityId,
+          "infisical.identity.name": identity.name,
+          "infisical.organization.id": org.id,
+          "infisical.organization.name": org.name,
+          "infisical.identity.auth_method": AuthAttemptAuthMethod.OCI_AUTH,
+          "infisical.identity.auth_result": AuthAttemptAuthResult.SUCCESS,
+          "client.address": requestContext.get("ip"),
+          "user_agent.original": requestContext.get("userAgent")
+        });
+      }
 
-    return {
-      identityOciAuth,
-      accessToken,
-      identityAccessToken,
-      identity
-    };
+      return {
+        identityOciAuth,
+        accessToken,
+        identityAccessToken,
+        identity
+      };
+    } catch (error) {
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.identity.id": identityOciAuth.identityId,
+          "infisical.identity.name": identity.name,
+          "infisical.organization.id": org.id,
+          "infisical.organization.name": org.name,
+          "infisical.identity.auth_method": AuthAttemptAuthMethod.OCI_AUTH,
+          "infisical.identity.auth_result": AuthAttemptAuthResult.FAILURE,
+          "client.address": requestContext.get("ip"),
+          "user_agent.original": requestContext.get("userAgent")
+        });
+      }
+      throw error;
+    }
   };
 
   const attachOciAuth = async ({

backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts

@@ -1,4 +1,5 @@
 import { ForbiddenError } from "@casl/ability";
+import { requestContext } from "@fastify/request-context";
 import axios from "axios";
 import https from "https";
 import jwt from "jsonwebtoken";
@@ -22,6 +23,7 @@ import {
   UnauthorizedError
 } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
+import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 import { getValueByDot } from "@app/lib/template/dot-access";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -67,6 +69,7 @@ export const identityOidcAuthServiceFactory = ({
   orgDAL
 }: TIdentityOidcAuthServiceFactoryDep) => {
   const login = async ({ identityId, jwt: oidcJwt }: TLoginOidcAuthDTO) => {
+    const appCfg = getConfig();
     const identityOidcAuth = await identityOidcAuthDAL.findOne({ identityId });
     if (!identityOidcAuth) {
       throw new NotFoundError({ message: "OIDC auth method not found for identity, did you configure OIDC auth?" });
@@ -75,151 +78,180 @@ export const identityOidcAuthServiceFactory = ({
     const identity = await identityDAL.findById(identityOidcAuth.identityId);
     if (!identity) throw new UnauthorizedError({ message: "Identity not found" });
 
-    const { decryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.Organization,
-      orgId: identity.orgId
-    });
-
-    let caCert = "";
-    if (identityOidcAuth.encryptedCaCertificate) {
-      caCert = decryptor({ cipherTextBlob: identityOidcAuth.encryptedCaCertificate }).toString();
-    }
-
-    const requestAgent = new https.Agent({ ca: caCert, rejectUnauthorized: !!caCert });
-    const { data: discoveryDoc } = await axios.get<{ jwks_uri: string }>(
-      `${identityOidcAuth.oidcDiscoveryUrl}/.well-known/openid-configuration`,
-      {
-        httpsAgent: identityOidcAuth.oidcDiscoveryUrl.includes("https") ? requestAgent : undefined
-      }
-    );
-    const jwksUri = discoveryDoc.jwks_uri;
-
-    const decodedToken = crypto.jwt().decode(oidcJwt, { complete: true });
-    if (!decodedToken) {
-      throw new UnauthorizedError({
-        message: "Invalid JWT"
-      });
-    }
-
-    const client = new JwksClient({
-      jwksUri,
-      requestAgent: identityOidcAuth.oidcDiscoveryUrl.includes("https") ? requestAgent : undefined
-    });
-
-    const { kid } = decodedToken.header as { kid: string };
-    const oidcSigningKey = await client.getSigningKey(kid);
-
-    let tokenData: Record<string, string>;
+    const org = await orgDAL.findById(identity.orgId);
     try {
-      tokenData = crypto.jwt().verify(oidcJwt, oidcSigningKey.getPublicKey(), {
-        issuer: identityOidcAuth.boundIssuer
-      }) as Record<string, string>;
-    } catch (error) {
-      if (error instanceof jwt.JsonWebTokenError) {
+      const { decryptor } = await kmsService.createCipherPairWithDataKey({
+        type: KmsDataKey.Organization,
+        orgId: identity.orgId
+      });
+
+      let caCert = "";
+      if (identityOidcAuth.encryptedCaCertificate) {
+        caCert = decryptor({ cipherTextBlob: identityOidcAuth.encryptedCaCertificate }).toString();
+      }
+
+      const requestAgent = new https.Agent({ ca: caCert, rejectUnauthorized: !!caCert });
+      const { data: discoveryDoc } = await axios.get<{ jwks_uri: string }>(
+        `${identityOidcAuth.oidcDiscoveryUrl}/.well-known/openid-configuration`,
+        {
+          httpsAgent: identityOidcAuth.oidcDiscoveryUrl.includes("https") ? requestAgent : undefined
+        }
+      );
+      const jwksUri = discoveryDoc.jwks_uri;
+
+      const decodedToken = crypto.jwt().decode(oidcJwt, { complete: true });
+      if (!decodedToken) {
         throw new UnauthorizedError({
-          message: `Access denied: ${error.message}`
+          message: "Invalid JWT"
+        });
+      }
+
+      const client = new JwksClient({
+        jwksUri,
+        requestAgent: identityOidcAuth.oidcDiscoveryUrl.includes("https") ? requestAgent : undefined
+      });
+
+      const { kid } = decodedToken.header as { kid: string };
+      const oidcSigningKey = await client.getSigningKey(kid);
+
+      let tokenData: Record<string, string>;
+      try {
+        tokenData = crypto.jwt().verify(oidcJwt, oidcSigningKey.getPublicKey(), {
+          issuer: identityOidcAuth.boundIssuer
+        }) as Record<string, string>;
+      } catch (error) {
+        if (error instanceof jwt.JsonWebTokenError) {
+          throw new UnauthorizedError({
+            message: `Access denied: ${error.message}`
+          });
+        }
+        throw error;
+      }
+
+      if (identityOidcAuth.boundSubject) {
+        if (!doesFieldValueMatchOidcPolicy(tokenData.sub, identityOidcAuth.boundSubject)) {
+          throw new ForbiddenRequestError({
+            message: "Access denied: OIDC subject not allowed."
+          });
+        }
+      }
+
+      if (identityOidcAuth.boundAudiences) {
+        if (
+          !identityOidcAuth.boundAudiences
+            .split(", ")
+            .some((policyValue) => doesAudValueMatchOidcPolicy(tokenData.aud, policyValue))
+        ) {
+          throw new UnauthorizedError({
+            message: "Access denied: OIDC audience not allowed."
+          });
+        }
+      }
+
+      if (identityOidcAuth.boundClaims) {
+        Object.keys(identityOidcAuth.boundClaims).forEach((claimKey) => {
+          const claimValue = (identityOidcAuth.boundClaims as Record<string, string>)[claimKey];
+          const value = getValueByDot(tokenData, claimKey);
+
+          if (!value) {
+            throw new UnauthorizedError({
+              message: `Access denied: token has no ${claimKey} field`
+            });
+          }
+
+          // handle both single and multi-valued claims
+          if (!claimValue.split(", ").some((claimEntry) => doesFieldValueMatchOidcPolicy(value, claimEntry))) {
+            throw new UnauthorizedError({
+              message: "Access denied: OIDC claim not allowed."
+            });
+          }
+        });
+      }
+
+      const filteredClaims: Record<string, string> = {};
+      if (identityOidcAuth.claimMetadataMapping) {
+        Object.keys(identityOidcAuth.claimMetadataMapping).forEach((permissionKey) => {
+          const claimKey = (identityOidcAuth.claimMetadataMapping as Record<string, string>)[permissionKey];
+          const value = getValueByDot(tokenData, claimKey);
+          if (!value) {
+            throw new UnauthorizedError({
+              message: `Access denied: token has no ${claimKey} field`
+            });
+          }
+          filteredClaims[permissionKey] = value.toString();
+        });
+      }
+
+      const identityAccessToken = await identityOidcAuthDAL.transaction(async (tx) => {
+        await membershipIdentityDAL.update(
+          { scope: AccessScope.Organization, scopeOrgId: identity.orgId, actorIdentityId: identity.id },
+          { lastLoginAuthMethod: IdentityAuthMethod.OIDC_AUTH, lastLoginTime: new Date() },
+          tx
+        );
+        const newToken = await identityAccessTokenDAL.create(
+          {
+            identityId: identityOidcAuth.identityId,
+            isAccessTokenRevoked: false,
+            accessTokenTTL: identityOidcAuth.accessTokenTTL,
+            accessTokenMaxTTL: identityOidcAuth.accessTokenMaxTTL,
+            accessTokenNumUses: 0,
+            accessTokenNumUsesLimit: identityOidcAuth.accessTokenNumUsesLimit,
+            authMethod: IdentityAuthMethod.OIDC_AUTH
+          },
+          tx
+        );
+        return newToken;
+      });
+
+      const accessToken = crypto.jwt().sign(
+        {
+          identityId: identityOidcAuth.identityId,
+          identityAccessTokenId: identityAccessToken.id,
+          authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN,
+          identityAuth: {
+            oidc: {
+              claims: filteredClaims
+            }
+          }
+        } as TIdentityAccessTokenJwtPayload,
+        appCfg.AUTH_SECRET,
+        // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
+        Number(identityAccessToken.accessTokenTTL) === 0
+          ? undefined
+          : {
+              expiresIn: Number(identityAccessToken.accessTokenTTL)
+            }
+      );
+
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.identity.id": identityOidcAuth.identityId,
+          "infisical.identity.name": identity.name,
+          "infisical.organization.id": org.id,
+          "infisical.organization.name": org.name,
+          "infisical.identity.auth_method": AuthAttemptAuthMethod.OIDC_AUTH,
+          "infisical.identity.auth_result": AuthAttemptAuthResult.SUCCESS,
+          "client.address": requestContext.get("ip"),
+          "user_agent.original": requestContext.get("userAgent")
+        });
+      }
+
+      return { accessToken, identityOidcAuth, identityAccessToken, identity, oidcTokenData: tokenData };
+    } catch (error) {
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.identity.id": identityOidcAuth.identityId,
+          "infisical.identity.name": identity.name,
+          "infisical.organization.id": org.id,
+          "infisical.organization.name": org.name,
+          "infisical.identity.auth_method": AuthAttemptAuthMethod.OIDC_AUTH,
+          "infisical.identity.auth_result": AuthAttemptAuthResult.FAILURE,
+          "client.address": requestContext.get("ip"),
+          "user_agent.original": requestContext.get("userAgent")
         });
       }
       throw error;
     }
-
-    if (identityOidcAuth.boundSubject) {
-      if (!doesFieldValueMatchOidcPolicy(tokenData.sub, identityOidcAuth.boundSubject)) {
-        throw new ForbiddenRequestError({
-          message: "Access denied: OIDC subject not allowed."
-        });
-      }
-    }
-
-    if (identityOidcAuth.boundAudiences) {
-      if (
-        !identityOidcAuth.boundAudiences
-          .split(", ")
-          .some((policyValue) => doesAudValueMatchOidcPolicy(tokenData.aud, policyValue))
-      ) {
-        throw new UnauthorizedError({
-          message: "Access denied: OIDC audience not allowed."
-        });
-      }
-    }
-
-    if (identityOidcAuth.boundClaims) {
-      Object.keys(identityOidcAuth.boundClaims).forEach((claimKey) => {
-        const claimValue = (identityOidcAuth.boundClaims as Record<string, string>)[claimKey];
-        const value = getValueByDot(tokenData, claimKey);
-
-        if (!value) {
-          throw new UnauthorizedError({
-            message: `Access denied: token has no ${claimKey} field`
-          });
-        }
-
-        // handle both single and multi-valued claims
-        if (!claimValue.split(", ").some((claimEntry) => doesFieldValueMatchOidcPolicy(value, claimEntry))) {
-          throw new UnauthorizedError({
-            message: "Access denied: OIDC claim not allowed."
-          });
-        }
-      });
-    }
-
-    const filteredClaims: Record<string, string> = {};
-    if (identityOidcAuth.claimMetadataMapping) {
-      Object.keys(identityOidcAuth.claimMetadataMapping).forEach((permissionKey) => {
-        const claimKey = (identityOidcAuth.claimMetadataMapping as Record<string, string>)[permissionKey];
-        const value = getValueByDot(tokenData, claimKey);
-        if (!value) {
-          throw new UnauthorizedError({
-            message: `Access denied: token has no ${claimKey} field`
-          });
-        }
-        filteredClaims[permissionKey] = value.toString();
-      });
-    }
-
-    const identityAccessToken = await identityOidcAuthDAL.transaction(async (tx) => {
-      await membershipIdentityDAL.update(
-        { scope: AccessScope.Organization, scopeOrgId: identity.orgId, actorIdentityId: identity.id },
-        { lastLoginAuthMethod: IdentityAuthMethod.OIDC_AUTH, lastLoginTime: new Date() },
-        tx
-      );
-      const newToken = await identityAccessTokenDAL.create(
-        {
-          identityId: identityOidcAuth.identityId,
-          isAccessTokenRevoked: false,
-          accessTokenTTL: identityOidcAuth.accessTokenTTL,
-          accessTokenMaxTTL: identityOidcAuth.accessTokenMaxTTL,
-          accessTokenNumUses: 0,
-          accessTokenNumUsesLimit: identityOidcAuth.accessTokenNumUsesLimit,
-          authMethod: IdentityAuthMethod.OIDC_AUTH
-        },
-        tx
-      );
-      return newToken;
-    });
-
-    const appCfg = getConfig();
-    const accessToken = crypto.jwt().sign(
-      {
-        identityId: identityOidcAuth.identityId,
-        identityAccessTokenId: identityAccessToken.id,
-        authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN,
-        identityAuth: {
-          oidc: {
-            claims: filteredClaims
-          }
-        }
-      } as TIdentityAccessTokenJwtPayload,
-      appCfg.AUTH_SECRET,
-      // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
-      Number(identityAccessToken.accessTokenTTL) === 0
-        ? undefined
-        : {
-            expiresIn: Number(identityAccessToken.accessTokenTTL)
-          }
-    );
-
-    return { accessToken, identityOidcAuth, identityAccessToken, identity, oidcTokenData: tokenData };
   };
 
   const attachOidcAuth = async ({

backend/src/services/identity-tls-cert-auth/identity-tls-cert-auth-service.ts

@@ -1,4 +1,5 @@
 import { ForbiddenError } from "@casl/ability";
+import { requestContext } from "@fastify/request-context";
 
 import { AccessScope, IdentityAuthMethod, OrganizationActionScope } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
@@ -19,6 +20,7 @@ import {
   UnauthorizedError
 } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
+import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
 import { TIdentityDALFactory } from "../identity/identity-dal";
@@ -27,6 +29,7 @@ import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identit
 import { TKmsServiceFactory } from "../kms/kms-service";
 import { KmsDataKey } from "../kms/kms-types";
 import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
+import { TOrgDALFactory } from "../org/org-dal";
 import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns";
 import { TIdentityTlsCertAuthDALFactory } from "./identity-tls-cert-auth-dal";
 import { TIdentityTlsCertAuthServiceFactory } from "./identity-tls-cert-auth-types";
@@ -42,6 +45,7 @@ type TIdentityTlsCertAuthServiceFactoryDep = {
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
   permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
+  orgDAL: Pick<TOrgDALFactory, "findById">;
 };
 
 const parseSubjectDetails = (data: string) => {
@@ -60,9 +64,11 @@ export const identityTlsCertAuthServiceFactory = ({
   membershipIdentityDAL,
   licenseService,
   permissionService,
-  kmsService
+  kmsService,
+  orgDAL
 }: TIdentityTlsCertAuthServiceFactoryDep): TIdentityTlsCertAuthServiceFactory => {
   const login: TIdentityTlsCertAuthServiceFactory["login"] = async ({ identityId, clientCertificate }) => {
+    const appCfg = getConfig();
     const identityTlsCertAuth = await identityTlsCertAuthDAL.findOne({ identityId });
     if (!identityTlsCertAuth) {
       throw new NotFoundError({
@@ -73,94 +79,124 @@ export const identityTlsCertAuthServiceFactory = ({
     const identity = await identityDAL.findById(identityTlsCertAuth.identityId);
     if (!identity) throw new UnauthorizedError({ message: "Identity not found" });
 
-    const { decryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.Organization,
-      orgId: identity.orgId
-    });
+    const org = await orgDAL.findById(identity.orgId);
 
-    const caCertificate = decryptor({
-      cipherTextBlob: identityTlsCertAuth.encryptedCaCertificate
-    }).toString();
-
-    const leafCertificate = extractX509CertFromChain(decodeURIComponent(clientCertificate))?.[0];
-    if (!leafCertificate) {
-      throw new BadRequestError({ message: "Missing client certificate" });
-    }
-
-    const clientCertificateX509 = new crypto.nativeCrypto.X509Certificate(leafCertificate);
-    const caCertificateX509 = new crypto.nativeCrypto.X509Certificate(caCertificate);
-
-    const isValidCertificate = clientCertificateX509.verify(caCertificateX509.publicKey);
-    if (!isValidCertificate)
-      throw new UnauthorizedError({
-        message: "Access denied: Certificate not issued by the provided CA."
+    try {
+      const { decryptor } = await kmsService.createCipherPairWithDataKey({
+        type: KmsDataKey.Organization,
+        orgId: identity.orgId
       });
 
-    if (new Date(clientCertificateX509.validTo) < new Date()) {
-      throw new UnauthorizedError({
-        message: "Access denied: Certificate has expired."
-      });
-    }
+      const caCertificate = decryptor({
+        cipherTextBlob: identityTlsCertAuth.encryptedCaCertificate
+      }).toString();
 
-    if (new Date(clientCertificateX509.validFrom) > new Date()) {
-      throw new UnauthorizedError({
-        message: "Access denied: Certificate not yet valid."
-      });
-    }
+      const leafCertificate = extractX509CertFromChain(decodeURIComponent(clientCertificate))?.[0];
+      if (!leafCertificate) {
+        throw new BadRequestError({ message: "Missing client certificate" });
+      }
 
-    const subjectDetails = parseSubjectDetails(clientCertificateX509.subject);
-    if (identityTlsCertAuth.allowedCommonNames) {
-      const isValidCommonName = identityTlsCertAuth.allowedCommonNames.split(",").includes(subjectDetails.CN);
-      if (!isValidCommonName) {
+      const clientCertificateX509 = new crypto.nativeCrypto.X509Certificate(leafCertificate);
+      const caCertificateX509 = new crypto.nativeCrypto.X509Certificate(caCertificate);
+
+      const isValidCertificate = clientCertificateX509.verify(caCertificateX509.publicKey);
+      if (!isValidCertificate)
         throw new UnauthorizedError({
-          message: "Access denied: TLS Certificate Auth common name not allowed."
+          message: "Access denied: Certificate not issued by the provided CA."
+        });
+
+      if (new Date(clientCertificateX509.validTo) < new Date()) {
+        throw new UnauthorizedError({
+          message: "Access denied: Certificate has expired."
         });
       }
-    }
 
-    // Generate the token
-    const identityAccessToken = await identityTlsCertAuthDAL.transaction(async (tx) => {
-      await membershipIdentityDAL.update(
-        { scope: AccessScope.Organization, scopeOrgId: identity.orgId, actorIdentityId: identity.id },
-        { lastLoginAuthMethod: IdentityAuthMethod.TLS_CERT_AUTH, lastLoginTime: new Date() },
-        tx
-      );
-      const newToken = await identityAccessTokenDAL.create(
+      if (new Date(clientCertificateX509.validFrom) > new Date()) {
+        throw new UnauthorizedError({
+          message: "Access denied: Certificate not yet valid."
+        });
+      }
+
+      const subjectDetails = parseSubjectDetails(clientCertificateX509.subject);
+      if (identityTlsCertAuth.allowedCommonNames) {
+        const isValidCommonName = identityTlsCertAuth.allowedCommonNames.split(",").includes(subjectDetails.CN);
+        if (!isValidCommonName) {
+          throw new UnauthorizedError({
+            message: "Access denied: TLS Certificate Auth common name not allowed."
+          });
+        }
+      }
+
+      // Generate the token
+      const identityAccessToken = await identityTlsCertAuthDAL.transaction(async (tx) => {
+        await membershipIdentityDAL.update(
+          { scope: AccessScope.Organization, scopeOrgId: identity.orgId, actorIdentityId: identity.id },
+          { lastLoginAuthMethod: IdentityAuthMethod.TLS_CERT_AUTH, lastLoginTime: new Date() },
+          tx
+        );
+        const newToken = await identityAccessTokenDAL.create(
+          {
+            identityId: identityTlsCertAuth.identityId,
+            isAccessTokenRevoked: false,
+            accessTokenTTL: identityTlsCertAuth.accessTokenTTL,
+            accessTokenMaxTTL: identityTlsCertAuth.accessTokenMaxTTL,
+            accessTokenNumUses: 0,
+            accessTokenNumUsesLimit: identityTlsCertAuth.accessTokenNumUsesLimit,
+            authMethod: IdentityAuthMethod.TLS_CERT_AUTH
+          },
+          tx
+        );
+        return newToken;
+      });
+
+      const accessToken = crypto.jwt().sign(
         {
           identityId: identityTlsCertAuth.identityId,
-          isAccessTokenRevoked: false,
-          accessTokenTTL: identityTlsCertAuth.accessTokenTTL,
-          accessTokenMaxTTL: identityTlsCertAuth.accessTokenMaxTTL,
-          accessTokenNumUses: 0,
-          accessTokenNumUsesLimit: identityTlsCertAuth.accessTokenNumUsesLimit,
-          authMethod: IdentityAuthMethod.TLS_CERT_AUTH
-        },
-        tx
+          identityAccessTokenId: identityAccessToken.id,
+          authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
+        } as TIdentityAccessTokenJwtPayload,
+        appCfg.AUTH_SECRET,
+        Number(identityAccessToken.accessTokenTTL) === 0
+          ? undefined
+          : {
+              expiresIn: Number(identityAccessToken.accessTokenTTL)
+            }
       );
-      return newToken;
-    });
 
-    const appCfg = getConfig();
-    const accessToken = crypto.jwt().sign(
-      {
-        identityId: identityTlsCertAuth.identityId,
-        identityAccessTokenId: identityAccessToken.id,
-        authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
-      } as TIdentityAccessTokenJwtPayload,
-      appCfg.AUTH_SECRET,
-      Number(identityAccessToken.accessTokenTTL) === 0
-        ? undefined
-        : {
-            expiresIn: Number(identityAccessToken.accessTokenTTL)
-          }
-    );
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.identity.id": identityTlsCertAuth.identityId,
+          "infisical.identity.name": identity.name,
+          "infisical.organization.id": org.id,
+          "infisical.organization.name": org.name,
+          "infisical.identity.auth_method": AuthAttemptAuthMethod.TLS_CERT_AUTH,
+          "infisical.identity.auth_result": AuthAttemptAuthResult.SUCCESS,
+          "client.address": requestContext.get("ip"),
+          "user_agent.original": requestContext.get("userAgent")
+        });
+      }
 
-    return {
-      identityTlsCertAuth,
-      accessToken,
-      identityAccessToken,
-      identity
-    };
+      return {
+        identityTlsCertAuth,
+        accessToken,
+        identityAccessToken,
+        identity
+      };
+    } catch (error) {
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.identity.id": identityTlsCertAuth.identityId,
+          "infisical.identity.name": identity.name,
+          "infisical.organization.id": org.id,
+          "infisical.organization.name": org.name,
+          "infisical.identity.auth_method": AuthAttemptAuthMethod.TLS_CERT_AUTH,
+          "infisical.identity.auth_result": AuthAttemptAuthResult.FAILURE,
+          "client.address": requestContext.get("ip"),
+          "user_agent.original": requestContext.get("userAgent")
+        });
+      }
+      throw error;
+    }
   };
 
   const attachTlsCertAuth: TIdentityTlsCertAuthServiceFactory["attachTlsCertAuth"] = async ({

backend/src/services/identity-ua/identity-ua-service.ts

@@ -1,4 +1,5 @@
 import { ForbiddenError } from "@casl/ability";
+import { requestContext } from "@fastify/request-context";
 
 import { AccessScope, IdentityAuthMethod, OrganizationActionScope } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
@@ -21,6 +22,7 @@ import {
 } from "@app/lib/errors";
 import { checkIPAgainstBlocklist, extractIPDetails, isValidIpOrCidr, TIp } from "@app/lib/ip";
 import { logger } from "@app/lib/logger";
+import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
 import { TIdentityDALFactory } from "../identity/identity-dal";
@@ -77,6 +79,7 @@ export const identityUaServiceFactory = ({
   identityDAL
 }: TIdentityUaServiceFactoryDep) => {
   const login = async (clientId: string, clientSecret: string, ip: string) => {
+    const appCfg = getConfig();
     const identityUa = await identityUaDAL.findOne({ clientId });
     if (!identityUa) {
       throw new UnauthorizedError({
@@ -84,196 +87,226 @@ export const identityUaServiceFactory = ({
       });
     }
 
-    checkIPAgainstBlocklist({
-      ipAddress: ip,
-      trustedIps: identityUa.clientSecretTrustedIps as TIp[]
-    });
+    const identity = await identityDAL.findById(identityUa.identityId);
+    const org = await orgDAL.findById(identity.orgId);
 
-    const LOCKOUT_KEY = `lockout:identity:${identityUa.identityId}:${IdentityAuthMethod.UNIVERSAL_AUTH}:${clientId}`;
-
-    const lockoutRaw = await keyStore.getItem(LOCKOUT_KEY);
-
-    let lockout: LockoutObject | undefined;
-    if (lockoutRaw) {
-      lockout = JSON.parse(lockoutRaw) as LockoutObject;
-    }
-
-    if (lockout && lockout.lockedOut) {
-      throw new UnauthorizedError({
-        message: "This identity auth method is temporarily locked, please try again later"
+    try {
+      checkIPAgainstBlocklist({
+        ipAddress: ip,
+        trustedIps: identityUa.clientSecretTrustedIps as TIp[]
       });
-    }
 
-    const clientSecretPrefix = clientSecret.slice(0, 4);
-    const clientSecretInfo = await identityUaClientSecretDAL.find({
-      identityUAId: identityUa.id,
-      isClientSecretRevoked: false,
-      clientSecretPrefix
-    });
+      const LOCKOUT_KEY = `lockout:identity:${identityUa.identityId}:${IdentityAuthMethod.UNIVERSAL_AUTH}:${clientId}`;
 
-    let validClientSecretInfo: (typeof clientSecretInfo)[0] | null = null;
-    for await (const info of clientSecretInfo) {
-      const isMatch = await crypto.hashing().compareHash(clientSecret, info.clientSecretHash);
+      const lockoutRaw = await keyStore.getItem(LOCKOUT_KEY);
 
-      if (isMatch) {
-        validClientSecretInfo = info;
-        break;
+      let lockout: LockoutObject | undefined;
+      if (lockoutRaw) {
+        lockout = JSON.parse(lockoutRaw) as LockoutObject;
       }
-    }
 
-    if (!validClientSecretInfo) {
-      if (identityUa.lockoutEnabled) {
-        let lock: Awaited<ReturnType<typeof keyStore.acquireLock>> | undefined;
-        try {
-          lock = await keyStore.acquireLock([KeyStorePrefixes.IdentityLockoutLock(LOCKOUT_KEY)], 300, {
-            retryCount: 3,
-            retryDelay: 300,
-            retryJitter: 100
-          });
+      if (lockout && lockout.lockedOut) {
+        throw new UnauthorizedError({
+          message: "This identity auth method is temporarily locked, please try again later"
+        });
+      }
 
-          // Re-fetch the latest lockout data while holding the lock
-          const lockoutRawNew = await keyStore.getItem(LOCKOUT_KEY);
-          if (lockoutRawNew) {
-            lockout = JSON.parse(lockoutRawNew) as LockoutObject;
-          } else {
-            lockout = {
-              lockedOut: false,
-              failedAttempts: 0
-            };
-          }
+      const clientSecretPrefix = clientSecret.slice(0, 4);
+      const clientSecretInfo = await identityUaClientSecretDAL.find({
+        identityUAId: identityUa.id,
+        isClientSecretRevoked: false,
+        clientSecretPrefix
+      });
 
-          if (lockout.lockedOut) {
-            throw new UnauthorizedError({
-              message: "This identity auth method is temporarily locked, please try again later"
-            });
-          }
+      let validClientSecretInfo: (typeof clientSecretInfo)[0] | null = null;
+      for await (const info of clientSecretInfo) {
+        const isMatch = await crypto.hashing().compareHash(clientSecret, info.clientSecretHash);
 
-          lockout.failedAttempts += 1;
-          if (lockout.failedAttempts >= identityUa.lockoutThreshold) {
-            lockout.lockedOut = true;
-          }
-
-          await keyStore.setItemWithExpiry(
-            LOCKOUT_KEY,
-            lockout.lockedOut ? identityUa.lockoutDurationSeconds : identityUa.lockoutCounterResetSeconds,
-            JSON.stringify(lockout)
-          );
-        } catch (e) {
-          if (lock === undefined) {
-            logger.info(
-              `identity login failed to acquire lock [identityId=${identityUa.identityId}] [authMethod=${IdentityAuthMethod.UNIVERSAL_AUTH}]`
-            );
-            throw new RateLimitError({ message: "Failed to acquire lock: rate limit exceeded" });
-          }
-          throw e;
-        } finally {
-          if (lock) {
-            await lock.release();
-          }
+        if (isMatch) {
+          validClientSecretInfo = info;
+          break;
         }
       }
 
-      throw new UnauthorizedError({ message: "Invalid credentials" });
-    } else if (lockout) {
-      // If credentials are valid, clear any existing lockout record
-      await keyStore.deleteItem(LOCKOUT_KEY);
-    }
+      if (!validClientSecretInfo) {
+        if (identityUa.lockoutEnabled) {
+          let lock: Awaited<ReturnType<typeof keyStore.acquireLock>> | undefined;
+          try {
+            lock = await keyStore.acquireLock([KeyStorePrefixes.IdentityLockoutLock(LOCKOUT_KEY)], 300, {
+              retryCount: 3,
+              retryDelay: 300,
+              retryJitter: 100
+            });
 
-    const { clientSecretTTL, clientSecretNumUses, clientSecretNumUsesLimit } = validClientSecretInfo;
-    if (Number(clientSecretTTL) > 0) {
-      const clientSecretCreated = new Date(validClientSecretInfo.createdAt);
-      const ttlInMilliseconds = Number(clientSecretTTL) * 1000;
-      const currentDate = new Date();
-      const expirationTime = new Date(clientSecretCreated.getTime() + ttlInMilliseconds);
+            // Re-fetch the latest lockout data while holding the lock
+            const lockoutRawNew = await keyStore.getItem(LOCKOUT_KEY);
+            if (lockoutRawNew) {
+              lockout = JSON.parse(lockoutRawNew) as LockoutObject;
+            } else {
+              lockout = {
+                lockedOut: false,
+                failedAttempts: 0
+              };
+            }
 
-      if (currentDate > expirationTime) {
+            if (lockout.lockedOut) {
+              throw new UnauthorizedError({
+                message: "This identity auth method is temporarily locked, please try again later"
+              });
+            }
+
+            lockout.failedAttempts += 1;
+            if (lockout.failedAttempts >= identityUa.lockoutThreshold) {
+              lockout.lockedOut = true;
+            }
+
+            await keyStore.setItemWithExpiry(
+              LOCKOUT_KEY,
+              lockout.lockedOut ? identityUa.lockoutDurationSeconds : identityUa.lockoutCounterResetSeconds,
+              JSON.stringify(lockout)
+            );
+          } catch (e) {
+            if (lock === undefined) {
+              logger.info(
+                `identity login failed to acquire lock [identityId=${identityUa.identityId}] [authMethod=${IdentityAuthMethod.UNIVERSAL_AUTH}]`
+              );
+              throw new RateLimitError({ message: "Failed to acquire lock: rate limit exceeded" });
+            }
+            throw e;
+          } finally {
+            if (lock) {
+              await lock.release();
+            }
+          }
+        }
+
+        throw new UnauthorizedError({ message: "Invalid credentials" });
+      } else if (lockout) {
+        // If credentials are valid, clear any existing lockout record
+        await keyStore.deleteItem(LOCKOUT_KEY);
+      }
+
+      const { clientSecretTTL, clientSecretNumUses, clientSecretNumUsesLimit } = validClientSecretInfo;
+      if (Number(clientSecretTTL) > 0) {
+        const clientSecretCreated = new Date(validClientSecretInfo.createdAt);
+        const ttlInMilliseconds = Number(clientSecretTTL) * 1000;
+        const currentDate = new Date();
+        const expirationTime = new Date(clientSecretCreated.getTime() + ttlInMilliseconds);
+
+        if (currentDate > expirationTime) {
+          await identityUaClientSecretDAL.updateById(validClientSecretInfo.id, {
+            isClientSecretRevoked: true
+          });
+
+          throw new UnauthorizedError({
+            message: "Access denied due to expired client secret"
+          });
+        }
+      }
+
+      if (clientSecretNumUsesLimit > 0 && clientSecretNumUses >= clientSecretNumUsesLimit) {
+        // number of times client secret can be used for
+        // a login operation reached
         await identityUaClientSecretDAL.updateById(validClientSecretInfo.id, {
           isClientSecretRevoked: true
         });
-
         throw new UnauthorizedError({
-          message: "Access denied due to expired client secret"
+          message: "Access denied due to client secret usage limit reached"
         });
       }
-    }
 
-    if (clientSecretNumUsesLimit > 0 && clientSecretNumUses >= clientSecretNumUsesLimit) {
-      // number of times client secret can be used for
-      // a login operation reached
-      await identityUaClientSecretDAL.updateById(validClientSecretInfo.id, {
-        isClientSecretRevoked: true
+      const accessTokenTTLParams =
+        Number(identityUa.accessTokenPeriod) === 0
+          ? {
+              accessTokenTTL: identityUa.accessTokenTTL,
+              accessTokenMaxTTL: identityUa.accessTokenMaxTTL
+            }
+          : {
+              accessTokenTTL: identityUa.accessTokenPeriod,
+              // We set a very large Max TTL for periodic tokens to ensure that clients (even outdated ones) can always renew their token
+              // without them having to update their SDKs, CLIs, etc. This workaround sets it to 30 years to emulate "forever"
+              accessTokenMaxTTL: 1000000000
+            };
+
+      const identityAccessToken = await identityUaDAL.transaction(async (tx) => {
+        const uaClientSecretDoc = await identityUaClientSecretDAL.incrementUsage(validClientSecretInfo!.id, tx);
+        await membershipIdentityDAL.update(
+          { scope: AccessScope.Organization, scopeOrgId: identity.orgId, actorIdentityId: identity.id },
+          {
+            lastLoginAuthMethod: IdentityAuthMethod.UNIVERSAL_AUTH,
+            lastLoginTime: new Date()
+          },
+          tx
+        );
+        const newToken = await identityAccessTokenDAL.create(
+          {
+            identityId: identityUa.identityId,
+            isAccessTokenRevoked: false,
+            identityUAClientSecretId: uaClientSecretDoc.id,
+            accessTokenNumUses: 0,
+            accessTokenNumUsesLimit: identityUa.accessTokenNumUsesLimit,
+            accessTokenPeriod: identityUa.accessTokenPeriod,
+            authMethod: IdentityAuthMethod.UNIVERSAL_AUTH,
+            ...accessTokenTTLParams
+          },
+          tx
+        );
+
+        return newToken;
       });
-      throw new UnauthorizedError({
-        message: "Access denied due to client secret usage limit reached"
-      });
-    }
 
-    const accessTokenTTLParams =
-      Number(identityUa.accessTokenPeriod) === 0
-        ? {
-            accessTokenTTL: identityUa.accessTokenTTL,
-            accessTokenMaxTTL: identityUa.accessTokenMaxTTL
-          }
-        : {
-            accessTokenTTL: identityUa.accessTokenPeriod,
-            // We set a very large Max TTL for periodic tokens to ensure that clients (even outdated ones) can always renew their token
-            // without them having to update their SDKs, CLIs, etc. This workaround sets it to 30 years to emulate "forever"
-            accessTokenMaxTTL: 1000000000
-          };
-
-    const identity = await identityDAL.findById(identityUa.identityId);
-    const identityAccessToken = await identityUaDAL.transaction(async (tx) => {
-      const uaClientSecretDoc = await identityUaClientSecretDAL.incrementUsage(validClientSecretInfo!.id, tx);
-      await membershipIdentityDAL.update(
-        { scope: AccessScope.Organization, scopeOrgId: identity.orgId, actorIdentityId: identity.id },
-        {
-          lastLoginAuthMethod: IdentityAuthMethod.UNIVERSAL_AUTH,
-          lastLoginTime: new Date()
-        },
-        tx
-      );
-      const newToken = await identityAccessTokenDAL.create(
+      const accessToken = crypto.jwt().sign(
         {
           identityId: identityUa.identityId,
-          isAccessTokenRevoked: false,
-          identityUAClientSecretId: uaClientSecretDoc.id,
-          accessTokenNumUses: 0,
-          accessTokenNumUsesLimit: identityUa.accessTokenNumUsesLimit,
-          accessTokenPeriod: identityUa.accessTokenPeriod,
-          authMethod: IdentityAuthMethod.UNIVERSAL_AUTH,
-          ...accessTokenTTLParams
-        },
-        tx
+          clientSecretId: validClientSecretInfo.id,
+          identityAccessTokenId: identityAccessToken.id,
+          authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
+        } as TIdentityAccessTokenJwtPayload,
+        appCfg.AUTH_SECRET,
+        // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
+        Number(identityAccessToken.accessTokenTTL) === 0
+          ? undefined
+          : {
+              expiresIn: Number(identityAccessToken.accessTokenTTL)
+            }
       );
 
-      return newToken;
-    });
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.identity.id": identityUa.identityId,
+          "infisical.identity.name": identity.name,
+          "infisical.organization.id": org.id,
+          "infisical.organization.name": org.name,
+          "infisical.identity.auth_method": AuthAttemptAuthMethod.UNIVERSAL_AUTH,
+          "infisical.identity.auth_result": AuthAttemptAuthResult.SUCCESS,
+          "client.address": requestContext.get("ip"),
+          "user_agent.original": requestContext.get("userAgent")
+        });
+      }
 
-    const appCfg = getConfig();
-    const accessToken = crypto.jwt().sign(
-      {
-        identityId: identityUa.identityId,
-        clientSecretId: validClientSecretInfo.id,
-        identityAccessTokenId: identityAccessToken.id,
-        authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
-      } as TIdentityAccessTokenJwtPayload,
-      appCfg.AUTH_SECRET,
-      // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
-      Number(identityAccessToken.accessTokenTTL) === 0
-        ? undefined
-        : {
-            expiresIn: Number(identityAccessToken.accessTokenTTL)
-          }
-    );
-
-    return {
-      accessToken,
-      identityUa,
-      validClientSecretInfo,
-      identityAccessToken,
-      identity,
-      ...accessTokenTTLParams
-    };
+      return {
+        accessToken,
+        identityUa,
+        validClientSecretInfo,
+        identityAccessToken,
+        identity,
+        ...accessTokenTTLParams
+      };
+    } catch (error) {
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.identity.id": identityUa.identityId,
+          "infisical.identity.name": identity.name,
+          "infisical.organization.id": org.id,
+          "infisical.organization.name": org.name,
+          "infisical.identity.auth_method": AuthAttemptAuthMethod.UNIVERSAL_AUTH,
+          "infisical.identity.auth_result": AuthAttemptAuthResult.FAILURE,
+          "client.address": requestContext.get("ip"),
+          "user_agent.original": requestContext.get("userAgent")
+        });
+      }
+      throw error;
+    }
   };
 
   const attachUniversalAuth = async ({

backend/src/services/kms/kms-service.ts

@@ -401,13 +401,6 @@ export const kmsServiceFactory = ({
 
     const cipher = symmetricCipherService(SymmetricKeyAlgorithm.AES_GCM_256);
 
-    const expectedByteLength = getByteLengthForSymmetricEncryptionAlgorithm(algorithm as SymmetricKeyAlgorithm);
-    if (key.byteLength !== expectedByteLength) {
-      throw new BadRequestError({
-        message: `Invalid key length for ${algorithm}. Expected ${expectedByteLength} bytes but got ${key.byteLength} bytes`
-      });
-    }
-
     const encryptedKeyMaterial = cipher.encrypt(key, ROOT_ENCRYPTION_KEY);
     const sanitizedName = name ? slugify(name) : slugify(alphaNumericNanoId(8).toLowerCase());
     const dbQuery = async (db: Knex) => {

backend/src/services/membership-group/membership-group-service.ts

@@ -1,5 +1,15 @@
-import { AccessScope, ProjectMembershipRole, TemporaryPermissionMode, TMembershipRolesInsert } from "@app/db/schemas";
+import {
+  AccessScope,
+  ProjectMembershipRole,
+  TableName,
+  TemporaryPermissionMode,
+  TMembershipRolesInsert
+} from "@app/db/schemas";
+import { TAccessApprovalPolicyApproverDALFactory } from "@app/ee/services/access-approval-policy/access-approval-policy-approver-dal";
+import { TAccessApprovalPolicyDALFactory } from "@app/ee/services/access-approval-policy/access-approval-policy-dal";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
+import { TSecretApprovalPolicyApproverDALFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-approver-dal";
+import { TSecretApprovalPolicyDALFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-dal";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
 import { ms } from "@app/lib/ms";
@@ -23,6 +33,10 @@ import { newProjectMembershipGroupFactory } from "./project/project-membership-g
 type TMembershipGroupServiceFactoryDep = {
   membershipGroupDAL: TMembershipGroupDALFactory;
   membershipRoleDAL: Pick<TMembershipRoleDALFactory, "insertMany" | "delete">;
+  accessApprovalPolicyDAL: Pick<TAccessApprovalPolicyDALFactory, "find">;
+  accessApprovalPolicyApproverDAL: Pick<TAccessApprovalPolicyApproverDALFactory, "find">;
+  secretApprovalPolicyDAL: Pick<TSecretApprovalPolicyDALFactory, "find">;
+  secretApprovalPolicyApproverDAL: Pick<TSecretApprovalPolicyApproverDALFactory, "find">;
   roleDAL: Pick<TRoleDALFactory, "find">;
   permissionService: TPermissionServiceFactory;
   orgDAL: TOrgDALFactory;
@@ -33,6 +47,10 @@ export type TMembershipGroupServiceFactory = ReturnType<typeof membershipGroupSe
 export const membershipGroupServiceFactory = ({
   membershipGroupDAL,
   roleDAL,
+  accessApprovalPolicyDAL,
+  accessApprovalPolicyApproverDAL,
+  secretApprovalPolicyDAL,
+  secretApprovalPolicyApproverDAL,
   membershipRoleDAL,
   orgDAL,
   permissionService
@@ -268,6 +286,48 @@ export const membershipGroupServiceFactory = ({
         message: "You can't delete your own membership"
       });
 
+    const accessApprovalPolicyApprovers = await accessApprovalPolicyApproverDAL.find({
+      approverGroupId: dto.selector.groupId
+    });
+
+    // check if group is assigned to any access approval policy
+    const accessApprovalPolicyApproverGroupIds = accessApprovalPolicyApprovers.map(({ policyId }) => policyId);
+    if (accessApprovalPolicyApprovers.length > 0) {
+      const accessApprovalPolicies = await accessApprovalPolicyDAL.find({
+        $in: {
+          [`${TableName.AccessApprovalPolicy}.id` as "id"]: [...new Set(accessApprovalPolicyApproverGroupIds)]
+        },
+        projectId: existingMembership.scopeProjectId ?? undefined,
+        deletedAt: null
+      });
+
+      if (accessApprovalPolicies.length > 0) {
+        throw new BadRequestError({
+          message: "This group is assigned to an approval policy and cannot be deleted"
+        });
+      }
+    }
+
+    // check if group is assigned to any secret approval policy
+    const secretApprovalPolicyApprovers = await secretApprovalPolicyApproverDAL.find({
+      approverGroupId: dto.selector.groupId
+    });
+    const secretApprovalPolicyApproverGroupIds = secretApprovalPolicyApprovers.map(({ policyId }) => policyId);
+    if (secretApprovalPolicyApprovers.length > 0) {
+      const secretApprovalPolicies = await secretApprovalPolicyDAL.find({
+        $in: {
+          [`${TableName.SecretApprovalPolicy}.id` as "id"]: [...new Set(secretApprovalPolicyApproverGroupIds)]
+        },
+        projectId: existingMembership.scopeProjectId ?? undefined,
+        deletedAt: null
+      });
+      if (secretApprovalPolicies.length > 0) {
+        throw new BadRequestError({
+          message: "This group is assigned to a secret approval policy and cannot be deleted"
+        });
+      }
+    }
+
     const membershipDoc = await membershipGroupDAL.transaction(async (tx) => {
       await membershipRoleDAL.delete({ membershipId: existingMembership.id }, tx);
       const doc = await membershipGroupDAL.deleteById(existingMembership.id, tx);

backend/src/services/secret-sync/northflank/index.ts

@@ -0,0 +1,4 @@
+export * from "./northflank-sync-constants";
+export * from "./northflank-sync-fns";
+export * from "./northflank-sync-schemas";
+export * from "./northflank-sync-types";

backend/src/services/secret-sync/northflank/northflank-sync-constants.ts

@@ -0,0 +1,10 @@
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+import { TSecretSyncListItem } from "@app/services/secret-sync/secret-sync-types";
+
+export const NORTHFLANK_SYNC_LIST_OPTION: TSecretSyncListItem = {
+  name: "Northflank",
+  destination: SecretSync.Northflank,
+  connection: AppConnection.Northflank,
+  canImportSecrets: true
+};

backend/src/services/secret-sync/northflank/northflank-sync-fns.ts

@@ -0,0 +1,165 @@
+import { AxiosError } from "axios";
+
+import { request } from "@app/lib/config/request";
+import { matchesSchema } from "@app/services/secret-sync/secret-sync-fns";
+import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
+
+import { SecretSyncError } from "../secret-sync-errors";
+import { TNorthflankSyncWithCredentials } from "./northflank-sync-types";
+
+const NORTHFLANK_API_URL = "https://api.northflank.com";
+
+const buildNorthflankAPIErrorMessage = (error: unknown): string => {
+  let errorMessage = "Northflank API returned an error.";
+
+  if (error && typeof error === "object" && "response" in error) {
+    const axiosError = error as AxiosError;
+
+    if (axiosError.response?.data) {
+      // This is the shape of the error response from the Northflank API
+      const responseData = axiosError.response.data as {
+        error?: { message?: string; details?: Record<string, string[]> };
+        message?: string;
+      };
+      const errorParts = [];
+
+      if (responseData.error?.message) {
+        errorParts.push(responseData.error.message);
+      } else if (responseData.message) {
+        errorParts.push(responseData.message);
+      }
+
+      if (responseData.error?.details) {
+        const { details } = responseData.error;
+
+        // Flatten the details object into a string
+        Object.entries(details).forEach(([field, fieldErrors]) => {
+          if (Array.isArray(fieldErrors)) {
+            fieldErrors.forEach((fieldError) => errorParts.push(`${field}: ${fieldError}`));
+          } else {
+            errorParts.push(`${field}: ${String(fieldErrors)}`);
+          }
+        });
+      }
+
+      errorMessage += ` ${errorParts.join(". ")}`;
+    }
+  }
+
+  return errorMessage;
+};
+
+const getNorthflankSecrets = async (secretSync: TNorthflankSyncWithCredentials): Promise<Record<string, string>> => {
+  const {
+    destinationConfig: { projectId, secretGroupId },
+    connection: {
+      credentials: { apiToken }
+    }
+  } = secretSync;
+
+  try {
+    const {
+      data: {
+        data: {
+          secrets: { variables }
+        }
+      }
+    } = await request.get<{
+      data: {
+        secrets: {
+          variables: Record<string, string>;
+        };
+      };
+    }>(`${NORTHFLANK_API_URL}/v1/projects/${projectId}/secrets/${secretGroupId}/details`, {
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        Accept: "application/json"
+      }
+    });
+
+    return variables;
+  } catch (error: unknown) {
+    throw new SecretSyncError({
+      error,
+      message: `Failed to fetch Northflank secrets. ${buildNorthflankAPIErrorMessage(error)}`
+    });
+  }
+};
+
+const updateNorthflankSecrets = async (
+  secretSync: TNorthflankSyncWithCredentials,
+  variables: Record<string, string>
+): Promise<void> => {
+  const {
+    destinationConfig: { projectId, secretGroupId },
+    connection: {
+      credentials: { apiToken }
+    }
+  } = secretSync;
+
+  try {
+    await request.patch(
+      `${NORTHFLANK_API_URL}/v1/projects/${projectId}/secrets/${secretGroupId}`,
+      {
+        secrets: {
+          variables
+        }
+      },
+      {
+        headers: {
+          Authorization: `Bearer ${apiToken}`,
+          Accept: "application/json"
+        }
+      }
+    );
+  } catch (error: unknown) {
+    throw new SecretSyncError({
+      error,
+      message: `Failed to update Northflank secrets. ${buildNorthflankAPIErrorMessage(error)}`
+    });
+  }
+};
+
+export const NorthflankSyncFns = {
+  syncSecrets: async (secretSync: TNorthflankSyncWithCredentials, secretMap: TSecretMap): Promise<void> => {
+    const northflankSecrets = await getNorthflankSecrets(secretSync);
+
+    const updatedVariables: Record<string, string> = {};
+
+    for (const [key, value] of Object.entries(northflankSecrets)) {
+      const shouldKeep =
+        !secretMap[key] && // this prevents duplicates from infisical secrets, because we add all of them to the updateVariables in the next loop
+        (secretSync.syncOptions.disableSecretDeletion ||
+          !matchesSchema(key, secretSync.environment?.slug || "", secretSync.syncOptions.keySchema));
+
+      if (shouldKeep) {
+        updatedVariables[key] = value;
+      }
+    }
+
+    for (const [key, { value }] of Object.entries(secretMap)) {
+      updatedVariables[key] = value;
+    }
+
+    await updateNorthflankSecrets(secretSync, updatedVariables);
+  },
+
+  getSecrets: async (secretSync: TNorthflankSyncWithCredentials): Promise<TSecretMap> => {
+    const northflankSecrets = await getNorthflankSecrets(secretSync);
+    return Object.fromEntries(Object.entries(northflankSecrets).map(([key, value]) => [key, { value }]));
+  },
+
+  removeSecrets: async (secretSync: TNorthflankSyncWithCredentials, secretMap: TSecretMap): Promise<void> => {
+    const northflankSecrets = await getNorthflankSecrets(secretSync);
+
+    const updatedVariables: Record<string, string> = {};
+
+    for (const [key, value] of Object.entries(northflankSecrets)) {
+      if (!(key in secretMap)) {
+        updatedVariables[key] = value;
+      }
+    }
+
+    await updateNorthflankSecrets(secretSync, updatedVariables);
+  }
+};

backend/src/services/secret-sync/northflank/northflank-sync-schemas.ts

@@ -0,0 +1,54 @@
+import { z } from "zod";
+
+import { SecretSyncs } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+import {
+  BaseSecretSyncSchema,
+  GenericCreateSecretSyncFieldsSchema,
+  GenericUpdateSecretSyncFieldsSchema
+} from "@app/services/secret-sync/secret-sync-schemas";
+import { TSyncOptionsConfig } from "@app/services/secret-sync/secret-sync-types";
+
+const NorthflankSyncDestinationConfigSchema = z.object({
+  projectId: z
+    .string()
+    .trim()
+    .min(1, "Project ID is required")
+    .describe(SecretSyncs.DESTINATION_CONFIG.NORTHFLANK.projectId),
+  projectName: z.string().trim().optional().describe(SecretSyncs.DESTINATION_CONFIG.NORTHFLANK.projectName),
+  secretGroupId: z
+    .string()
+    .trim()
+    .min(1, "Secret Group ID is required")
+    .describe(SecretSyncs.DESTINATION_CONFIG.NORTHFLANK.secretGroupId),
+  secretGroupName: z.string().trim().optional().describe(SecretSyncs.DESTINATION_CONFIG.NORTHFLANK.secretGroupName)
+});
+
+const NorthflankSyncOptionsConfig: TSyncOptionsConfig = { canImportSecrets: true };
+
+export const NorthflankSyncSchema = BaseSecretSyncSchema(SecretSync.Northflank, NorthflankSyncOptionsConfig).extend({
+  destination: z.literal(SecretSync.Northflank),
+  destinationConfig: NorthflankSyncDestinationConfigSchema
+});
+
+export const CreateNorthflankSyncSchema = GenericCreateSecretSyncFieldsSchema(
+  SecretSync.Northflank,
+  NorthflankSyncOptionsConfig
+).extend({
+  destinationConfig: NorthflankSyncDestinationConfigSchema
+});
+
+export const UpdateNorthflankSyncSchema = GenericUpdateSecretSyncFieldsSchema(
+  SecretSync.Northflank,
+  NorthflankSyncOptionsConfig
+).extend({
+  destinationConfig: NorthflankSyncDestinationConfigSchema.optional()
+});
+
+export const NorthflankSyncListItemSchema = z.object({
+  name: z.literal("Northflank"),
+  connection: z.literal(AppConnection.Northflank),
+  destination: z.literal(SecretSync.Northflank),
+  canImportSecrets: z.literal(true)
+});

backend/src/services/secret-sync/northflank/northflank-sync-types.ts

@@ -0,0 +1,19 @@
+import { z } from "zod";
+
+import { TNorthflankConnection } from "@app/services/app-connection/northflank";
+
+import {
+  CreateNorthflankSyncSchema,
+  NorthflankSyncListItemSchema,
+  NorthflankSyncSchema
+} from "./northflank-sync-schemas";
+
+export type TNorthflankSyncListItem = z.infer<typeof NorthflankSyncListItemSchema>;
+
+export type TNorthflankSync = z.infer<typeof NorthflankSyncSchema>;
+
+export type TNorthflankSyncInput = z.infer<typeof CreateNorthflankSyncSchema>;
+
+export type TNorthflankSyncWithCredentials = TNorthflankSync & {
+  connection: TNorthflankConnection;
+};

backend/src/services/secret-sync/secret-sync-enums.ts

@@ -28,6 +28,7 @@ export enum SecretSync {
   Checkly = "checkly",
   DigitalOceanAppPlatform = "digital-ocean-app-platform",
   Netlify = "netlify",
+  Northflank = "northflank",
   Bitbucket = "bitbucket",
   LaravelForge = "laravel-forge",
   Chef = "chef"

backend/src/services/secret-sync/secret-sync-fns.ts

@@ -52,6 +52,7 @@ import { HUMANITEC_SYNC_LIST_OPTION } from "./humanitec";
 import { HumanitecSyncFns } from "./humanitec/humanitec-sync-fns";
 import { LARAVEL_FORGE_SYNC_LIST_OPTION, LaravelForgeSyncFns } from "./laravel-forge";
 import { NETLIFY_SYNC_LIST_OPTION, NetlifySyncFns } from "./netlify";
+import { NORTHFLANK_SYNC_LIST_OPTION, NorthflankSyncFns } from "./northflank";
 import { RAILWAY_SYNC_LIST_OPTION } from "./railway/railway-sync-constants";
 import { RailwaySyncFns } from "./railway/railway-sync-fns";
 import { RENDER_SYNC_LIST_OPTION, RenderSyncFns } from "./render";
@@ -93,6 +94,7 @@ const SECRET_SYNC_LIST_OPTIONS: Record<SecretSync, TSecretSyncListItem> = {
   [SecretSync.Checkly]: CHECKLY_SYNC_LIST_OPTION,
   [SecretSync.DigitalOceanAppPlatform]: DIGITAL_OCEAN_APP_PLATFORM_SYNC_LIST_OPTION,
   [SecretSync.Netlify]: NETLIFY_SYNC_LIST_OPTION,
+  [SecretSync.Northflank]: NORTHFLANK_SYNC_LIST_OPTION,
   [SecretSync.Bitbucket]: BITBUCKET_SYNC_LIST_OPTION,
   [SecretSync.LaravelForge]: LARAVEL_FORGE_SYNC_LIST_OPTION,
   [SecretSync.Chef]: CHEF_SYNC_LIST_OPTION
@@ -279,6 +281,8 @@ export const SecretSyncFns = {
         return DigitalOceanAppPlatformSyncFns.syncSecrets(secretSync, schemaSecretMap);
       case SecretSync.Netlify:
         return NetlifySyncFns.syncSecrets(secretSync, schemaSecretMap);
+      case SecretSync.Northflank:
+        return NorthflankSyncFns.syncSecrets(secretSync, schemaSecretMap);
       case SecretSync.Bitbucket:
         return BitbucketSyncFns.syncSecrets(secretSync, schemaSecretMap);
       case SecretSync.LaravelForge:
@@ -398,6 +402,9 @@ export const SecretSyncFns = {
       case SecretSync.Netlify:
         secretMap = await NetlifySyncFns.getSecrets(secretSync);
         break;
+      case SecretSync.Northflank:
+        secretMap = await NorthflankSyncFns.getSecrets(secretSync);
+        break;
       case SecretSync.Bitbucket:
         secretMap = await BitbucketSyncFns.getSecrets(secretSync);
         break;
@@ -498,6 +505,8 @@ export const SecretSyncFns = {
         return DigitalOceanAppPlatformSyncFns.removeSecrets(secretSync, schemaSecretMap);
       case SecretSync.Netlify:
         return NetlifySyncFns.removeSecrets(secretSync, schemaSecretMap);
+      case SecretSync.Northflank:
+        return NorthflankSyncFns.removeSecrets(secretSync, schemaSecretMap);
       case SecretSync.Bitbucket:
         return BitbucketSyncFns.removeSecrets(secretSync, schemaSecretMap);
       case SecretSync.LaravelForge:

backend/src/services/secret-sync/secret-sync-maps.ts

@@ -32,6 +32,7 @@ export const SECRET_SYNC_NAME_MAP: Record<SecretSync, string> = {
   [SecretSync.Checkly]: "Checkly",
   [SecretSync.DigitalOceanAppPlatform]: "Digital Ocean App Platform",
   [SecretSync.Netlify]: "Netlify",
+  [SecretSync.Northflank]: "Northflank",
   [SecretSync.Bitbucket]: "Bitbucket",
   [SecretSync.LaravelForge]: "Laravel Forge",
   [SecretSync.Chef]: "Chef"
@@ -67,6 +68,7 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
   [SecretSync.Checkly]: AppConnection.Checkly,
   [SecretSync.DigitalOceanAppPlatform]: AppConnection.DigitalOcean,
   [SecretSync.Netlify]: AppConnection.Netlify,
+  [SecretSync.Northflank]: AppConnection.Northflank,
   [SecretSync.Bitbucket]: AppConnection.Bitbucket,
   [SecretSync.LaravelForge]: AppConnection.LaravelForge,
   [SecretSync.Chef]: AppConnection.Chef
@@ -102,6 +104,7 @@ export const SECRET_SYNC_PLAN_MAP: Record<SecretSync, SecretSyncPlanType> = {
   [SecretSync.Checkly]: SecretSyncPlanType.Regular,
   [SecretSync.DigitalOceanAppPlatform]: SecretSyncPlanType.Regular,
   [SecretSync.Netlify]: SecretSyncPlanType.Regular,
+  [SecretSync.Northflank]: SecretSyncPlanType.Regular,
   [SecretSync.Bitbucket]: SecretSyncPlanType.Regular,
   [SecretSync.LaravelForge]: SecretSyncPlanType.Regular,
   [SecretSync.Chef]: SecretSyncPlanType.Regular
@@ -146,6 +149,7 @@ export const SECRET_SYNC_SKIP_FIELDS_MAP: Record<SecretSync, string[]> = {
   [SecretSync.Checkly]: ["groupName", "accountName"],
   [SecretSync.DigitalOceanAppPlatform]: ["appName"],
   [SecretSync.Netlify]: ["accountName", "siteName"],
+  [SecretSync.Northflank]: [],
   [SecretSync.Bitbucket]: [],
   [SecretSync.LaravelForge]: [],
   [SecretSync.Chef]: []
@@ -207,6 +211,7 @@ export const DESTINATION_DUPLICATE_CHECK_MAP: Record<SecretSync, DestinationDupl
   [SecretSync.Checkly]: defaultDuplicateCheck,
   [SecretSync.DigitalOceanAppPlatform]: defaultDuplicateCheck,
   [SecretSync.Netlify]: defaultDuplicateCheck,
+  [SecretSync.Northflank]: defaultDuplicateCheck,
   [SecretSync.Bitbucket]: defaultDuplicateCheck,
   [SecretSync.LaravelForge]: defaultDuplicateCheck,
   [SecretSync.Chef]: defaultDuplicateCheck

backend/src/services/secret-sync/secret-sync-types.ts

@@ -125,6 +125,12 @@ import {
   TLaravelForgeSyncWithCredentials
 } from "./laravel-forge";
 import { TNetlifySync, TNetlifySyncInput, TNetlifySyncListItem, TNetlifySyncWithCredentials } from "./netlify";
+import {
+  TNorthflankSync,
+  TNorthflankSyncInput,
+  TNorthflankSyncListItem,
+  TNorthflankSyncWithCredentials
+} from "./northflank";
 import {
   TRailwaySync,
   TRailwaySyncInput,
@@ -189,6 +195,7 @@ export type TSecretSync =
   | TChecklySync
   | TSupabaseSync
   | TNetlifySync
+  | TNorthflankSync
   | TBitbucketSync;
 
 export type TSecretSyncWithCredentials =
@@ -222,6 +229,7 @@ export type TSecretSyncWithCredentials =
   | TSupabaseSyncWithCredentials
   | TDigitalOceanAppPlatformSyncWithCredentials
   | TNetlifySyncWithCredentials
+  | TNorthflankSyncWithCredentials
   | TBitbucketSyncWithCredentials
   | TLaravelForgeSyncWithCredentials;
 
@@ -256,6 +264,7 @@ export type TSecretSyncInput =
   | TSupabaseSyncInput
   | TDigitalOceanAppPlatformSyncInput
   | TNetlifySyncInput
+  | TNorthflankSyncInput
   | TBitbucketSyncInput
   | TLaravelForgeSyncInput;
 
@@ -291,6 +300,7 @@ export type TSecretSyncListItem =
   | TSupabaseSyncListItem
   | TDigitalOceanAppPlatformSyncListItem
   | TNetlifySyncListItem
+  | TNorthflankSyncListItem
   | TBitbucketSyncListItem;
 
 export type TSyncOptionsConfig = {

backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts

@@ -34,6 +34,7 @@ import { diff, groupBy } from "@app/lib/fn";
 import { setKnexStringValue } from "@app/lib/knex";
 import { logger } from "@app/lib/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
+import { recordSecretReadMetric } from "@app/lib/telemetry/metrics";
 
 import { ActorType } from "../auth/auth-type";
 import { TCommitResourceChangeDTO, TFolderCommitServiceFactory } from "../folder-commit/folder-commit-service";
@@ -1052,6 +1053,11 @@ export const secretV2BridgeServiceFactory = ({
     });
     throwIfMissingSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.DescribeSecret);
 
+    recordSecretReadMetric({
+      environment,
+      secretPath: path
+    });
+
     const cachedSecretDalVersion = await keyStore.pgGetIntItem(SecretServiceCacheKeys.getSecretDalVersion(projectId));
     const secretDalVersion = Number(cachedSecretDalVersion || 0);
     const cacheKey = SecretServiceCacheKeys.getSecretsOfServiceLayer(projectId, secretDalVersion, {
@@ -1482,6 +1488,12 @@ export const secretV2BridgeServiceFactory = ({
       secretTags: (secret?.tags || []).map((el) => el.slug)
     });
 
+    recordSecretReadMetric({
+      environment,
+      secretPath: path,
+      name: secretName
+    });
+
     // this will throw if the user doesn't have read value permission no matter what
     // because if its an expansion, it will fully depend on the value.
     const { expandSecretReferences } = expandSecretReferencesFactory({