Configuring logback.xml to log X-Forwarded-For/Client IP in audit logs in IdP v3

[Sheldon, Nathan I]

Hello all.

Was a solution for adding X-Forwarded-For HTTP header content to Shibboleth IdP 3.x audit (or any other) logs ever shared?  I was unable to find any posted solution in the list archive.

I’m using Tomcat 8 with Shibboleth IdP 3.3.  We’re using an F5 for load balancing.  Using SNAT and setting the default route in each IdP server node probably won’t be an option (as at lest one is on a different subnet).

I was able to get the IP address sent by our load balancer in the X-Forwarded-For header in the Tomcat localhost_access_log with the following configuration in the server.xml file.
——
        <Valve className="org.apache.catalina.valves.RemoteIpValve"
               remoteIpHeader="X-Forwarded-For"
               protocolHeaderHttpsValue="https" />

        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
               prefix="localhost_access_log" suffix=".txt"
               pattern="%{X-Forwarded-For}i %h %l %u %t "%r" %s %b" />
——
However, I’m not sure how (or even if it’s possible) to get that %{X-Forwarded-For}i result into a Shibboleth audit log.  My sense is that it’s more than just a simple /opt/shibboleth-idp/conf/logback.xml change.  Any pointers would be appreciated.

----
Nathan Sheldon (nathan.sheldon at ucsf.edu<mailto:nathan.sheldon at ucsf.edu>)




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170127/2b745def/attachment.html>