Logging in Bitbucket

For more information on audit- and regular logging in Bitbucket, please refer to this page:
https://wiki.resolution.de/doc/api-token-authentication/latest/admin-guide/logging/logging-in-bitbucket

Audit Logging 

The Jira and Confluence audit log holds records of key activities, such as adding new users, changing group memberships and many others.
Read more about it here: 
https://confluence.atlassian.com/adminjiraserver/auditing-in-jira-938847740.html 
https://confluence.atlassian.com/doc/auditing-in-confluence-829076528.html

Default Audit Logging

Since version 1.1.0, creating and deleting tokens (both deleting a single token or all for a user as an admin) is already always added to the audit log:

Advanced Audit Logging

Starting with version 1.5.0, sys-admins have more control over what events should be added to the audit log.

Please consider carefully what type of authentication events you want to audit-log.
Depending on the number of REST requests and the event types, the audit log size might increase very quickly.
Having a long audit log retention period combined with a lot of recorded events may affect your database and its performance.

You can select the events to be logged in the Audit Logging tab. All these are turned off by default.

1. Successful Authentication
2. Failed Authentication Attempts
   1. Audit-log failed API token authentication attempts
   2. Audit-log failed API token verification
3. Permission Denied

Examples

With 1 - Successful Authentication - activated, a successful authentication with an API token is recorded into the audit log.
Because of technical limitations, the author is shown as "Anonymous".  
The "Affected object(s)" column however is showing the reference to the user who logged in.

Option 2 - Audit-log failed API token authentication attempts - a) is only available, if basic authentication with regular passwords is disabled.
A valid API token is expected and if this is not the case, an audit record like the below is created.

It also includes logging of attempts coming from an IP address that is restricted by the app:

With 2 b) - Audit-log failed API token verification - activated, a lot of other API interactions with regular passwords might be recorded,
since there is no way to tell for certain if the authentication header contained a password or an API token.
Thus, it might lead to a lot of events being recorded and is usually not advised.






With 3 - Permission Denied - activated,
using tokens with "Read Only" scope for a write operation will result in a record like the below:

Audit Logging in Confluence

It seems that Confluence is showing the client IP address in the Load balancer/proxy IP address field and reverse.
This is already the case for audit-log records not created by the API Token app and seems to be a Confluence issue.

Logfile

After changing the log level for the package de.resolution.apitokenauth to INFO
Jira: https://your-jira/secure/admin/ViewLogging.jspa / read here on how to make the log level persistent
Confluence: https://your-confluence/admin/viewlog4j.action / read here on how to make the log level persistent

You'll then see the below authentication-related entries in the log file of Jira or Confluence. These entries contain:

• a description of the event
• the token description (if applicable for the event)
• the token scope (if applicable for the event) 
• the username
• the path of the REST endpoint for the call

When using Datacenter, the log file entries might be distributed across one or multiple nodes, depending on where the load balancer directed the request to.
You might not see anything on one node, but on others instead.

Successful Authentication

Failed Authentication Attempts

Only if basic authentication with a regular password is disabled in the app settings, it's safe to tell if a token provided was wrong, causing the below message in the log file:

Another reason for a failed authentication attempt might be an IP restriction:

If basic authentication with a regular password is enabled, it might still be a valid password that is accepted by the Jira- or Confluence password authenticator. Hence, the log message reads like this:

Permission Denied Events

If a token with a "Read Only" scope is used during a write operation, a 403 error is returned as REST response and leaves a log file entry like the below.
Other 403 errors logged by de.resolution.apitokenauth.ApiTokenAuthenticationService should only occur in rare events.

Rate Limited Requests

If rate-limiting is enabled, logging the package de.resolution.apitokenauth.platform.auth.ApiTokenRateLimiter on INFO level provides the below record in the log file. This has been added in version 1.9.4.