<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Thanks Scott.
<div class=""><br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Jan 27, 2017, at 2:31 PM, Cantor, Scott <<a href="mailto:cantor.2@osu.edu" class="">cantor.2@osu.edu</a>> wrote:</div>
<div class="">
<div class=""><br class="">
Just log the IP address as is documented [1], it's available as part of the MDC field set.<br class="">
</div>
</div>
</blockquote>
<div><br class="">
</div>
Got it. Found it in the documentation at <a href="https://logback.qos.ch/manual/mdc.html" class="">https://logback.qos.ch/manual/mdc.html</a></div>
<div><br class="">
<blockquote type="cite" class="">
<div class="">
<div class="">Are you sure the F5 actually prevents a client from asserting any X-Forwarded-For value it wants? NetScaler does not. I would advise that you check, because it turns out that assuming "not implemented by morons" is a false assumption by at least
one comparable vendor.<br class="">
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>Ha! I’ve found that assumption to be false of many enterprise applications/vendors. The F5 documentation at <a href="https://support.f5.com/csp/article/K4816" class="">https://support.f5.com/csp/article/K4816</a> seems to indicate that it generates it’s
X-Forwarded-For header using the value of the IP address in the packet in which the HTTP/S request was made. I don’t think it validates the IP beyond that. But, it does point out that, optionally (and not by default), the BIG-IP system can be configured
to trust, and append to existing X-Forwarded-For headers already in the HTTP request. I don’t believe this is how ours are configured, but I should confirm with the group that manages them.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div class="">In which case the IdP's existing support for logging the address should work.<br class="">
</div>
</div>
</blockquote>
</div>
<div class=""><br class="">
</div>
I got it to work with an additional MDC filter added to the edit-webapp/WEB-INF/web.xml file.</div>
<div class=""><br class="">
</div>
<div class="">For others who may find this helpful, I made the following edits to the following files to add the IP address provided in the X-Forwarded-For HTTP header to the /opt/shibboleth-idp/logs/idp-audit.log file output. I’m using Tomcat 8 and Shibboleth
IdP 3.3.0.</div>
<div class=""><br class="">
</div>
<div class="">Added to /opt/tomcat/conf/server.xml (this may not be required, but previous messages in this years old thread indicate that it is):</div>
<div class="">——</div>
<div class=""> <Valve className="org.apache.catalina.valves.RemoteIpValve"<br class="">
remoteIpHeader="X-Forwarded-For"<br class="">
protocolHeaderHttpsValue="https" /><br class="">
——</div>
<div class="">Added to /opt/shibboleth-sp/edit-webapp/WEB-INF/web.xml above the "<!-- Manages logging MDC. —>” section, then executed /opt/shibboleth-idp/bin/build.sh to deploy the change.</div>
<div class="">——</div>
<div class=""> <filter><br class="">
<filter-name>MDCInsertingServletFilter</filter-name><br class="">
<filter-class><br class="">
ch.qos.logback.classic.helpers.MDCInsertingServletFilter<br class="">
</filter-class><br class="">
</filter><br class="">
<filter-mapping><br class="">
<filter-name>MDCInsertingServletFilter</filter-name><br class="">
<url-pattern>/*</url-pattern><br class="">
</filter-mapping><br class="">
——</div>
<div class="">Edited the Audit log section of /opt/shibboleth-idp/conf/logback.xml. The entire Audit log section is now:</div>
<div class="">——</div>
<div class=""> <!-- Audit log. --><br class="">
<appender name="IDP_AUDIT" class="ch.qos.logback.core.rolling.RollingFileAppender"><br class="">
<File>${idp.logfiles}/idp-audit.log</File><br class="">
<br class="">
<rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy"><br class="">
<fileNamePattern>${idp.logfiles}/idp-audit-%d{yyyy-MM-dd}.log.gz</fileNamePattern><br class="">
<maxHistory>${idp.loghistory:-180}</maxHistory><br class="">
</rollingPolicy><br class="">
<br class="">
<encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder"><br class="">
<charset>UTF-8</charset><br class="">
<Pattern>%msg|%X{req.xForwardedFor}|%n</Pattern><br class="">
</encoder><br class="">
</appender></div>
<div class="">——</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">
<div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
----</div>
<div style="color: rgb(0, 0, 0); letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; orphans: auto; text-align: start; text-indent: 0px; widows: auto;">
Nathan Sheldon (<a href="mailto:nathan.sheldon@ucsf.edu" class="">nathan.sheldon@ucsf.edu</a>)</div>
<div style="color: rgb(0, 0, 0); letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; orphans: auto; text-align: start; text-indent: 0px; widows: auto;" class="">
<br class="">
</div>
</div>
</div>
</div>
<br class="Apple-interchange-newline">
<br class="Apple-interchange-newline">
</div>
<br class="">
</div>
</body>
</html>