Are all request headers accessible by Shib's Logback?

[John Morton]

Thanks Simon, I will look into that. However, if anyone else has a solution only requiring a config change to Shib, I would be very interested! It would also benefit anyone else looking to the same in Jetty.

- John

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Simon Lundström
Sent: Tuesday, January 09, 2018 1:16 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: Are all request headers accessible by Shib's Logback?

On Tue, 2018-01-09 at 01:00:49 +0000, John Morton wrote:
>Hello again. I am working toward going live with a new 3.3 deployment of Shibboleth, and while doing so, attempting to get our Service Desk a log that has all the relevant information they need to troubleshoot account lockouts.
>
>There is a header that Microsoft appends to ECP requests called X-MS-Forwarded-Client-IP. It contains the true client IP of the device that authenticates with them (that they pass through to us).
>
>I can get this header into my access log with Tomcat's access log valve, as it has access to all headers.
>
>However, it would be really great if I could use Shib's Logback instance to attach this to a message that it already knows about.
>
>I've read about the MDC and the AuditLogging framework, and have played with those, however I have not figured out how to get an arbitrary header.
>
>Does anyone know if this is possible or if I need to rely on Tomcat to log this data?

The standard X-Forwarded-For header is available via Logbacks MDC[1], see many threads on the mailinglist about this. Maybe you can either make Tomcat "rename" the X-MS-Forwarded-Client-IP header to X-F-F or just use the value of X-MS-F-C-IP in the X-F-F header?

Please report back if you have any success with it.

BR,
- Simon

1, <https://logback.qos.ch/manual/mdc.html#mis>
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net