Configuring logback.xml to log X-Forwarded-For/Client IP in audit logs in IdP v3

[Sheldon, Nathan I]

Thanks Scott.

On Jan 27, 2017, at 2:31 PM, Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:

Just log the IP address as is documented [1], it's available as part of the MDC field set.

Got it.  Found it in the documentation at https://logback.qos.ch/manual/mdc.html

Are you sure the F5 actually prevents a client from asserting any X-Forwarded-For value it wants? NetScaler does not. I would advise that you check, because it turns out that assuming "not implemented by morons" is a false assumption by at least one comparable vendor.

Ha!  I’ve found that assumption to be false of many enterprise applications/vendors.  The F5 documentation at https://support.f5.com/csp/article/K4816 seems to indicate that it generates it’s X-Forwarded-For header using the value of the IP address in the packet in which the HTTP/S request was made.  I don’t think it validates the IP beyond that.  But, it does point out that, optionally (and not by default), the BIG-IP system can be configured to trust, and append to existing X-Forwarded-For headers already in the HTTP request.  I don’t believe this is how ours are configured, but I should confirm with the group that manages them.

In which case the IdP's existing support for logging the address should work.

I got it to work with an additional MDC filter added to the edit-webapp/WEB-INF/web.xml file.

For others who may find this helpful, I made the following edits to the following files to add the IP address provided in the X-Forwarded-For HTTP header to the /opt/shibboleth-idp/logs/idp-audit.log file output.  I’m using Tomcat 8 and Shibboleth IdP 3.3.0.

Added to /opt/tomcat/conf/server.xml (this may not be required, but previous messages in this years old thread indicate that it is):
——
        <Valve className="org.apache.catalina.valves.RemoteIpValve"
               remoteIpHeader="X-Forwarded-For"
               protocolHeaderHttpsValue="https" />
——
Added to /opt/shibboleth-sp/edit-webapp/WEB-INF/web.xml above the "<!-- Manages logging MDC. —>” section, then executed /opt/shibboleth-idp/bin/build.sh to deploy the change.
——
    <filter>
        <filter-name>MDCInsertingServletFilter</filter-name>
        <filter-class>
            ch.qos.logback.classic.helpers.MDCInsertingServletFilter
        </filter-class>
    </filter>
    <filter-mapping>
        <filter-name>MDCInsertingServletFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
——
Edited the Audit log section of /opt/shibboleth-idp/conf/logback.xml.  The entire Audit log section is now:
——
    <!-- Audit log. -->
    <appender name="IDP_AUDIT" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <File>${idp.logfiles}/idp-audit.log</File>

        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
            <fileNamePattern>${idp.logfiles}/idp-audit-%d{yyyy-MM-dd}.log.gz</fileNamePattern>
            <maxHistory>${idp.loghistory:-180}</maxHistory>
        </rollingPolicy>

        <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
            <charset>UTF-8</charset>
            <Pattern>%msg|%X{req.xForwardedFor}|%n</Pattern>
        </encoder>
    </appender>
——

----
Nathan Sheldon (nathan.sheldon at ucsf.edu<mailto:nathan.sheldon at ucsf.edu>)




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170128/4ca66df1/attachment-0001.html>