<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">Hello Keith,</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">We are in the midst of migrating to GCP ourselves, so I had to deal with this just last week.  Below is how we've configured the RemoteIpValve:</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-size:small"><font face="monospace"><Valve className="org.apache.catalina.valves.RemoteIpValve"<br>       internalProxies="130\.211\.[0-3]\.\d{1,3}|35\.191\.\d{1,3}\.\d{1,3}|34\.9[6-9]\.\d{1,3}\.\d{1,3}"<br>       remoteIpHeader="X-Forwarded-For"<br>       remoteIpProxiesHeader="X-Forwarded-By"<br>       protocolHeader="X-Forwarded-Proto" /></font><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">All of the internal proxies listed there are GCP specific, so you will need to update that list with the internal proxies for the AWS ALB..</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">More information about configuring that valve can be found here:</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small"><a href="https://tomcat.apache.org/tomcat-8.0-doc/api/org/apache/catalina/valves/RemoteIpValve.html">https://tomcat.apache.org/tomcat-8.0-doc/api/org/apache/catalina/valves/RemoteIpValve.html</a><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">Cheers!</div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><font face="arial, helvetica, sans-serif"><br>Brian Moon<br><font size="1">Senior System Administrator, Enterprise Systems</font></font></div><div dir="ltr"><font size="1"><font face="arial, helvetica, sans-serif">Santa Clara University</font></font><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Jul 2, 2020 at 7:27 PM Wessel, Keith <<a href="mailto:kwessel@illinois.edu">kwessel@illinois.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">All,<br>
<br>
I've been operating our IdP behind load balancers that are kind enough to pass through the client's IP address as the source address instead of in the X-Forwarded-For header. As we begin a move to AWS with the Trusted Access Platform containers and an Amazon ALB, I now need to take an extra step to get Tomcat to use the X-Forwarded-For IP instead of the client IP (which is that of the ALB instead of the originating client). This is partly for logging of client IPs, but also for the access control facility.<br>
<br>
I've tried adding this to the <host> block of Tomcat's server.xml with no change in behavior:<br>
<br>
        <Valve className="org.apache.catalina.valves.RemoteIpValve" /><br>
<br>
The IP that appears in the IdP logs is still that of the ALB.<br>
<br>
Has anyone on this list found a way to get the originating client's IP instead of that of the load balancer inside the IdP when running Tomcat?<br>
<br>
Thanks,<br>
Keith<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://urldefense.com/v3/__https://wiki.shibboleth.net/confluence/x/coFAAg__;!!MLMg-p0Z!SZ8SFws3ujdjmL3MqgQ1I9trbhjbYA9S2T2fSgdcGqatKzPe_JL6GKyZVw5X$" rel="noreferrer" target="_blank">https://urldefense.com/v3/__https://wiki.shibboleth.net/confluence/x/coFAAg__;!!MLMg-p0Z!SZ8SFws3ujdjmL3MqgQ1I9trbhjbYA9S2T2fSgdcGqatKzPe_JL6GKyZVw5X$</a> <br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>