title: Access logging in Spring Security with Spring Boot OAuth2
body: <p>I'm using the Spring Boot OAuth2 (<a href="https://projects.spring.io/spring-security-oauth/docs/oauth2.html" rel="nofollow noreferrer">https://projects.spring.io/spring-security-oauth/docs/oauth2.html</a>), making my own authorization server.</p>
  
  <p>I haven't found a way to provide a coherent access log for users that hit <code>/oauth/token</code>, I'm wanting both successful and unsuccessful events. I've tried a lot of things, but they don't fulfill my needs in some way.</p>
  
  <ul>
  <li>Standard Spring Security <code>AuthenticationSuccessHandler</code>, <code>AuthenticationFailureHandler</code>, <code>AuthenticationEventPublisher</code>, <code>AccessDeniedHandler</code>, or <code>AuthenticationEntryPoint</code>: These don't seem to happen at all.</li>
  <li>Application events
  
  <ul>
  <li><code>AuthenticationCredentialsNotFoundEvent</code>: This happens, but I don't get any information about the client. Not even the username/client id.</li>
  <li><code>ServletRequestHandledEvent</code>: Good stuff, I get all the things, but only fires on success.</li>
  <li>Spring Boot <code>AuditApplicationEvent</code>: Only happens on failure and the user principle is "unknown". Not even the IP address is available.</li>
  </ul></li>
  <li><code>OAuth2AccessDeniedHandler</code>: This never happens either. I've installed it with the <code>AuthorizationServerSecurityConfigurer</code>, so I'm not sure what's going on with that. </li>
  </ul>
  
  <p>So is there not a way to log what happens? I would think that any security related framework would have something available.</p>