Enhance the observability of the authorization code flow when communicating with a third-party OAuth server

Expected Behavior

A switch to trun on logging to show the requests and responses in the Authorization Code Flow for the communication with the oauth server(for example, Apple, Facebook, Google, Microsoft) in the log.

Better to also decode the id token and the sensitive value like email, id and name should be masked.

Current Behavior

Not able to find how to show it. The actuator's httpexchange only shows the requests and response between UserAgent and application. I was putting several debug points in the code of the library and made screenshots and mask the sensitive values myself.

Context

This is required for legal purpose to make the data trasfer observable between the application and the 3rd party Auth server.

Start by tracing the Authorization Code Flow communication with the third-party OAuth server and compare it with the actuator's httpexchange coverage. Define the scope of the logging switch, ID-token decoding, and masking for sensitive values such as email, ID, and name. Done means the relevant requests and responses are observable without exposing those sensitive values, with coverage for the stated flow.