No warning or error logged on auth failure

[chrisinmtown]

I'm writing this issue to report that mod_oauth2 does not log any warning or error when token validation fails. I'm using the version installed on official Apache HTTPD 2.4-trixie docker image via apt-get install libapache2-mod-oauth2. I'll be glad to provide more information to pin down the exact version.

I'm trying to debug my configuration, I'm sure I have something wrong. I submit a request to a location protected by mod_oauth2, which silently rejects the token, HTTPD returns 401 and a generic message. The Apache output log shows only the access request and status code 401.

Then I finally used Apache directive LogLevel debug to enable debug-level logging for the entire Apache HTTPD server. With that in place, I see output from mod_oauth2. Below I pasted an excerpt, focusing on the line that indicates "invalid token". I only see debug-level entries here.

[Fri Jul 24 12:38:35.426755 2026] [oauth2:debug] [pid 13:tid 29] src/jose.c(1242): [client 10.10.10.236:54889] _oauth2_jose_jwt_payload_validate: enter
[Fri Jul 24 12:38:35.426758 2026] [oauth2:debug] [pid 13:tid 29] src/jose.c(1076): [client 10.10.10.236:54889] _oauth2_jose_jwt_validate_iss: enter: iss=(null), validate=required
[Fri Jul 24 12:38:35.426761 2026] [oauth2:debug] [pid 13:tid 29] src/jose.c(1116): [client 10.10.10.236:54889] _oauth2_jose_jwt_validate_iss: leave: 0
[Fri Jul 24 12:38:35.426763 2026] [oauth2:debug] [pid 13:tid 29] src/jose.c(1268): [client 10.10.10.236:54889] _oauth2_jose_jwt_payload_validate: leave: 0
[Fri Jul 24 12:38:35.426770 2026] [oauth2:debug] [pid 13:tid 29] src/jose.c(1384): [client 10.10.10.236:54889] oauth2_jose_jwt_verify: leave: 0
[Fri Jul 24 12:38:35.426773 2026] [oauth2:debug] [pid 13:tid 29] src/oauth2.c(914): [client 10.10.10.236:54889] oauth2_token_verify: leave: 0
[Fri Jul 24 12:38:35.426775 2026] [oauth2:debug] [pid 13:tid 29] src/server/apache.c(367): [client 10.10.10.236:54889] oauth2_apache_return_www_authenticate: enter
[Fri Jul 24 12:38:35.426779 2026] [oauth2:debug] [pid 13:tid 29] src/server/apache.c(459): [client 10.10.10.236:54889] oauth2_apache_hdr_out_add: WWW-Authenticate: Bearer error="invalid_token", error_description="Token could not be verified."
[Fri Jul 24 12:38:35.426785 2026] [oauth2:debug] [pid 13:tid 29] src/server/apache.c(391): [client 10.10.10.236:54889] oauth2_apache_return_www_authenticate: leave
[Fri Jul 24 12:38:35.426788 2026] [oauth2:debug] [pid 13:tid 29] src/mod_oauth2.c(143): [client 10.10.10.236:54889] oauth2_request_handler: leave

Please tell me if this is a reasonable expectation, that mod_oauth2 logs some detail about why it does not accept the token.

After a bit of digging, I see now that these logs are actually coming from liboauth2, here's a link:
https://github.com/OpenIDC/liboauth2/blob/master/src/server/apache.c#L459

Maybe I should write a ticket in that repo instead?

Thanks in advance for your guidance here.

[chrisinmtown]

Maybe I'm using a very old version? I cloned the source for liboauth2 and am on branch "master". There I see the line numbers from my debug output posted above are waaaay different from the current line numbers. For example, previously the function _oauth2_jose_jwt_payload_validate logged "enter" on line 1242 but in the current master branch that call appears on line 1387.