@Override
  public void onUnsuccessfulAuthentication(AmbariAuthenticationFilter filter, HttpServletRequest servletRequest, HttpServletResponse servletResponse, AmbariAuthenticationException cause) {
    String username;
    String message;
    String logMessage;
    Integer consecutiveFailures = null;
    boolean incrementFailureCount;

    if (cause == null) {
      username = null;
      message = "Unknown cause";
      incrementFailureCount = false;
    } else {
      username = cause.getUsername();
      message = cause.getLocalizedMessage();
      incrementFailureCount = cause.isCredentialFailure();
    }

    if (!StringUtils.isEmpty(username)) {
      // Only increment the authentication failure count if the authentication filter declares to
      // do so.
      if(incrementFailureCount && filter.shouldIncrementFailureCount()) {
        // Increment the user's consecutive authentication failure count.
        consecutiveFailures = users.incrementConsecutiveAuthenticationFailures(username);

        // If consecutiveFailures is NULL, then no user entry was found for the specified username.
        if (consecutiveFailures == null) {
          logMessage = String.format("Failed to authenticate %s: The user does not exist in the Ambari database", username);
        } else {
          logMessage = String.format("Failed to authenticate %s (attempt #%d): %s", username, consecutiveFailures, message);
        }
      }
      else {
        logMessage = String.format("Failed to authenticate %s: %s", username, message);
      }
    } else {
      logMessage = String.format("Failed to authenticate an unknown user: %s", message);
    }

    if (LOG.isDebugEnabled()) {
      LOG.debug(logMessage, cause);
    } else {
      LOG.info(logMessage);
    }

    // Using the Ambari audit logger, log this event (if enabled)
    if (auditLogger.isEnabled()) {
      AuditEvent loginFailedAuditEvent = LoginAuditEvent.builder()
          .withRemoteIp(RequestUtils.getRemoteAddress(servletRequest))
          .withTimestamp(System.currentTimeMillis())
          .withReasonOfFailure(message)
          .withConsecutiveFailures(consecutiveFailures)
          .withUserName(username)
          .withProxyUserName(null)
          .build();
      auditLogger.log(loginFailedAuditEvent);
    }
  }
PermissionHelper to help create audit entries
ambari-server/src/main/java/org/apache/ambari/server/security/authentication/AmbariAuthenticationEventHandlerImpl.java