You have roughly the right ideas, input event on the client sends a Server RPC to actually do the firing (perhaps with who the client thinks he hit and server can either trust him or do his own verify). It looks like you have the part right, but something is getting absorbed along the way and never calling the actual do damage logic.
ApplyDamage is being called, but the AnyDamage event never triggers:
-The blueprint is definitely executing on the server for the client who is shooting, correct? Both ApplyDamage and AnyDamage events are Authority Only so they will never run on clients (they can run for clients on server, but they dont run on the client ever).
-If this is running on the server, the best advice is to look at UGameplayStatics::ApplyDamage and step through. Perhaps damage applied ends up being 0 for some reason.