Access logging in Spring Security with Spring Boot OAuth2

Viewed 2479

I'm using the Spring Boot OAuth2 (https://projects.spring.io/spring-security-oauth/docs/oauth2.html), making my own authorization server.

I haven't found a way to provide a coherent access log for users that hit /oauth/token, I'm wanting both successful and unsuccessful events. I've tried a lot of things, but they don't fulfill my needs in some way.

  • Standard Spring Security AuthenticationSuccessHandler, AuthenticationFailureHandler, AuthenticationEventPublisher, AccessDeniedHandler, or AuthenticationEntryPoint: These don't seem to happen at all.
  • Application events
    • AuthenticationCredentialsNotFoundEvent: This happens, but I don't get any information about the client. Not even the username/client id.
    • ServletRequestHandledEvent: Good stuff, I get all the things, but only fires on success.
    • Spring Boot AuditApplicationEvent: Only happens on failure and the user principle is "unknown". Not even the IP address is available.
  • OAuth2AccessDeniedHandler: This never happens either. I've installed it with the AuthorizationServerSecurityConfigurer, so I'm not sure what's going on with that.

So is there not a way to log what happens? I would think that any security related framework would have something available.

0 Answers
Related