I'm using the Spring Boot OAuth2 (https://projects.spring.io/spring-security-oauth/docs/oauth2.html), making my own authorization server.
I haven't found a way to provide a coherent access log for users that hit /oauth/token, I'm wanting both successful and unsuccessful events. I've tried a lot of things, but they don't fulfill my needs in some way.
- Standard Spring Security
AuthenticationSuccessHandler,AuthenticationFailureHandler,AuthenticationEventPublisher,AccessDeniedHandler, orAuthenticationEntryPoint: These don't seem to happen at all. - Application events
AuthenticationCredentialsNotFoundEvent: This happens, but I don't get any information about the client. Not even the username/client id.ServletRequestHandledEvent: Good stuff, I get all the things, but only fires on success.- Spring Boot
AuditApplicationEvent: Only happens on failure and the user principle is "unknown". Not even the IP address is available.
OAuth2AccessDeniedHandler: This never happens either. I've installed it with theAuthorizationServerSecurityConfigurer, so I'm not sure what's going on with that.
So is there not a way to log what happens? I would think that any security related framework would have something available.