help with X-Forwarded-For with IDPv3.3.1 and jetty 9.3.16

[Matt Jamison]

Currently running Shibboleth IDP 3.3.1. I've managed to get most things
working by searching the the mailing list archive and google but I'm stuck
on this one.

I'm running Jetty 9.3.16 with HAProxy in front of it sending
x-forwarded-for header.

I enabled the http-forwarded module in jetty, which adds
the ForwardedRequestCustomizer and I
uncommented jetty.httpConfig.forwardedForHeader=X-Forwarded-For.

I even tried manually adding the below:
<Call name="addCustomizer">
   <Arg><New class="org.eclipse.jetty.server.ForwardedRequestCustomizer"
/></Arg>
</Call>

I read up on MDC here: https://logback.qos.ch/manual/mdc.html and added
this piece to my shibboleth-idp/webapp/WEB-INF/web.xml:

<filter>
  <filter-name>MDCInsertingServletFilter</filter-name>
  <filter-class>
    ch.qos.logback.classic.helpers.MDCInsertingServletFilter
  </filter-class>
</filter>
<filter-mapping>
  <filter-name>MDCInsertingServletFilter</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>


Edited shibboleth-idp/logback.xml and changed the line to be:

<Pattern>%X{req.xForwardedFor}|%X{req.remoteHost}|%msg%n</Pattern>

But I'm still not getting anything in the idp-audit.log for the IP address.

I know the x-forwarded-for header is coming through to jetty because I'm
using it to log the IPs in jetty's access log. I also have another jetty
app running that is also ingesting the x-forwarded-for just fine.

Any help would be greatly appreciated. An example would be amazing!

Thanks again!


~Matt
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170321/864f2ff5/attachment.html>