X-Forwarded-For on the IdP

[Turner, Andrew P]

Out of interest, why use the filter and not the Valve?

I have a one-liner in my sever.xml that seems to do what Elliot is asking for:

<Valve className="org.apache.catalina.valves.RemoteIpValve" internalProxies="regex representing IPs load balancer sends traffic on (SNAT pool)" />

Our IdP is behind F5 BIG-IPs.  It certainly seems to put the X-Forwarded-For header value in the IdP logs, but then I'm new to Tomcat and Shib :)

Andy

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of James Bardin
Sent: 09 February 2012 20:28
To: Shib Users
Subject: Re: X-Forwarded-For on the IdP

On Thu, Feb 9, 2012 at 3:19 PM, Elliot Kendall <elliot.kendall at emory.edu> wrote:
> We're certainly moving in that direction, but I expect it'll take a 
> while to get the IdPs to that point. For now, I'm looking into using 
> Tomcat's Remote IP Valve to get what I want.

You want to look at Tomcat's Remote IP Filter (not valve).
If you have apache in the mix, you can also use mod_rpaf.

-jim
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net