Logging issue - Shibb 3.3.2 - X-Forwarded-For

[Christopher Bongaarts]

On 4/13/2018 3:57 PM, Christopher Bernard wrote:
> I set up a new Test IdP (Shibboleth 3.3.2, RHEL7, Apache 2.4.6, Jetty 9.3) and test clients are all working against this new instance.
>
> Audit entries in the /opt/shibboleth-idp/logs/idp-audit.log are being stamped with the F5 load balancer's IP address instead of the IPs of the clients.  I followed the "Supporting X-Forwarded-For (Load Balancer)" section ofhttps://wiki.shibboleth.net/confluence/display/IDP30/Jetty93  , but I can't seem to change the outcome.

The Shib IdP relies on the container (in your case, Jetty) to provide 
the IP address of the connecting client.  So there's nothing to address 
on the Shib side - it's all in the Jetty configuration.

The easiest way is probably to use the built-in jetty-http-forwarded 
module. See the Jetty docs on the module:
http://www.eclipse.org/jetty/documentation/current/configuring-connectors.html#_advanced_configuration

and the docs on how to enable a module on startup:
http://www.eclipse.org/jetty/documentation/current/startup-modules.html

One caveat: if you want to use SSL on the backend leg (between the load 
balancer and the Shib server), you may have to do some additional work 
to make the jetty-http-forwarded module work on the SSL listener (out of 
the box, it only operates on the plain HTTP connector).

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%