Configuring logback.xml to log X-Forwarded-For/Client IP in audit logs in IdP v3

[Cantor, Scott]

On 1/27/17, 5:09 PM, "users on behalf of Sheldon, Nathan I" <users-bounces at shibboleth.net on behalf of Nathan.Sheldon at ucsf.edu> wrote:

> Was a solution for adding X-Forwarded-For HTTP header content to Shibboleth IdP 3.x audit (or any other) logs ever
> shared?  I was unable to find any posted solution in the list archive.

Just log the IP address as is documented [1], it's available as part of the MDC field set.
    
> I’m using Tomcat 8 with Shibboleth IdP 3.3.  We’re using an F5 for load balancing.  Using SNAT and setting the default
> route in each IdP server node probably won’t be an option (as at lest one is on a different subnet).

Are you sure the F5 actually prevents a client from asserting any X-Forwarded-For value it wants? NetScaler does not. I would advise that you check, because it turns out that assuming "not implemented by morons" is a false assumption by at least one comparable vendor.
        
>    I was able to get the IP address sent by our load balancer in the X-Forwarded-For header in the Tomcat
> localhost_access_log with the following configuration in the server.xml file.

In which case the IdP's existing support for logging the address should work.

-- Scott

[1] https://wiki.shibboleth.net/confluence/display/IDP30/LoggingConfiguration