You need to securely proxy an address header from the outermost proxy and install the appropriate features in the servlet container to pick it up, which will be in that container's documentation. -- Scott