Auditing IP Address

[Marvin Addison]

We are interested in logging source IP in audit logs to facilitate forensic
investigations. I assumed would be straightforward to add the %a audit
field to log the source IP, but I've ended up with little to show for my
efforts. It appears that the only way to get the source IP is thus:

PRC->SpringRequestContext->... lots of
drilling...->HttpServletRequest->getRemoteAddr()

Is that truly the only way? Assuming yes it seems fairly difficult for
getting at such an important piece of information as the source IP that one
might want to include in audit logs. I think we need something to
facilitate getting that information. Three options occur to me:

1. New context that holds the source IP (similar to UserAgentContext)
2. Add peerAddress field to MessageContext and populate for inbound message
3. Custom function to dig it out of the SpringRequestContext

Thoughts?

M
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160414/7dd5d73a/attachment.html>