help with X-Forwarded-For with IDPv3.3.1 and jetty 9.3.16

[Matt Jamison]

I had previously been using %a in audit.xml but when i was getting no IP, i
changed everything around to what I emailed earlier.

I revisited ForwardedRequestCustomizer in jetty and it appears adding
http-forwarded module wasn't working.

For anyone else that ever stumbles across this, here is what I did to get
it working:

In jetty.xml in my JETTY_HOME/etc/ (might work in JETTY_BASE but didn't
try) I added the below code in the httpConfig block:
      <Call name="addCustomizer">
        <Arg><New
class="org.eclipse.jetty.server.ForwardedRequestCustomizer" /></Arg>
     </Call>

Right after the last Set name= and before </New>

In shibboleth-idp/conf/audit.xml:
I added %a| right before the %T in the shibboleth.AuditFormattingMap block.

Now the idp-audit.log file has the IP of the x-forwarded-for, as well as
the idp-process.log file when someone logs in or out.

In HAProxy, which I am using as my load balancer, I added "http-request
del-header X-Forwarded-For" to the frontend block, so someone on the
outside cannot spoof that header. Also make sure to put "option forwardfor"
in your backend, so you get the X-Forwarded-For header passed on.

If there is a better way to do any of this, please let me know.

Thanks Scott for making me revisit the way I was doing things!

~Matt

On Tue, Mar 21, 2017 at 7:20 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 3/21/17, 5:48 PM, "users on behalf of Matt Jamison" <
> users-bounces at shibboleth.net on behalf of matt at tblinux.com> wrote:
>
> >  I read up on MDC here: https://logback.qos.ch/manual/mdc.html and
> added this piece to my shibboleth-idp/webapp/WEB-INF/web.xml:
>
> You don't need that.
>
> > Edited shibboleth-idp/logback.xml and changed the line to be:
>
> That isn't the name of the MDC variable is that carries the address.
> Please refer to the idP logging documentation for the MDC values.
>
> > But I'm still not getting anything in the idp-audit.log for the IP
> address.
>
> The audit log has a totally different design and you should log additional
> fields there by adjusting the audit format itself, not changing the logback
> file. That documentation is also explicit about the field labels for the
> data you want.
>
> -- Scott
>
>
>
>
>
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170322/dac86f12/attachment-0001.html>