Product/components used and version/fix level are you on:

API Gateway 10.11.0.14.328

Detailed explanation of the problem:

We have configure oauth2 using the Local Authorization server in API Gateway We would like to log successful getToken requests / refresh Tokens?
It will log in the failure case, but not in the success case.

I have updated the logging configuration in the Integration server to enable the Security Logger and selected all Security Areas to Audit.
This has generated a log, with information when I successfully log into the GUI, but not when I get an Oauth token.

Does anyone know if this is possible?

Error messages / full error message screenshot / log fileL

No error log

Is your question related to the free trial, or to a production (customer) instance?

Customer instance

Have you installed all the latest fixes for the products and systems you are using?

No

hi @nick_lomax24 ,
We dont provide the option to log the token as it is security breach.

Regards
Vikash Sharma

Hi Vikash,

Apologies, I should have updated the forum. I did manage to get it to work. Configuring the security log in the API GW gui, followed by an update in the integration server console to ensure Authentication and Authorization was selected worked.

I did find if I just updated it in the Integration server only, the configuration was lost when stopping and starting the integration server.

We can see success and failure of authentication when obtaining the token.

However, I do not obtain failed authorisation issues being logged. eg Asking for a scope you don’t have or not exists, as well as calling an API with a bearer token with the wrong scope.

I have set the server extended setting watt.server.oauth.log.authErrors to true and the error log is set for file.

https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files3/fdf9eadde722d62c7714b57e709fe1b2001aed67_2_1035x285.png 1.5x, https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files3/fdf9eadde722d62c7714b57e709fe1b2001aed67_2_1380x380.png 2x" data-dominant-color="FDFDFD">

image1706×471 34.2 KB

https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files3/f08e7ba267b1c914dbabe27f9b08a808ce2ddbdd_2_1035x348.png 1.5x, https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files/f08e7ba267b1c914dbabe27f9b08a808ce2ddbdd.png 2x" data-dominant-color="EBEBEB">

image1225×412 21.4 KB

According to the manual, I was expecting authorisation failure to be logged in the error log: Other errors, do appear in the error log, but not oauth authorisation ones.

Important Considerations for Using OAuth Features (softwareag.com)

This is what it says in the manual:
For OAuth authorization failures to appear in the error log, the watt.server.oauth.log.authErrors server configuration parameter must be set to true. By default, this parameter is set to false, meaning Integration Server does not write OAuth authorization errors to any log.

Is what I am trying to do considered to be an OAuth authorization failure?