Configuring logback.xml to log X-Forwarded-For/Client IP in audit logs in IdP v3

[Cantor, Scott]

On 9/22/15, 3:55 PM, "users on behalf of Khawer Masood" <users-bounces at shibboleth.net on behalf of shehzada at gwu.edu> wrote:

>To capture the end user’s IP address in the audit logs, I have tried these patterns in
>conf/logback.xml without success:
>
>
>1. <Pattern>%msg|%X{req.xForwardedFor}|%n</Pattern> — does not log anything in v3, but worked in Tomcat 6/IdP v2 (in conf/logging.xml) — see http://logback.qos.ch/manual/mdc.html#mis

If it worked in V2, you put it there, that's a servlet filter. If you want it, just add it. That was not part of V2.

>2. <Pattern>%msg|%mdc{req.xForwardedFor}|%n</Pattern> — does not log anything

That isn't what the documentation above says will be populated.

>3. <Pattern>%msg|%mdc{idp.remote_addr}|%n</Pattern> — logs the IP address
> of the httpd server[1]

That's *our* MDC key, which comes from getRemoteAddr().

>Our Load Balancer is setting X-Forwarded-For, and it appears correctly in httpd logs; a small java app I wrote to print all the headers, prints the X-Forwarded-For and other X-Forwarded headers correctly, so Jetty is getting it.

What matters is what getRemoteAddr() returns. If Jetty isn't changing that, you don't have it configured to use that request customizer thing.

>Our IdP setup is: Client > Load Balancer > Apache (mod_proxy) > Jetty

I would never advocate proxying twice, but that's more or less beside the point.

-- Scott