Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

This is a follow up from my earlier question on capturing the X-Forwarded-For IP address in across multiple proxies. Now, I'm looking to capture the Client's IP in the application's (Shibboleth's IdP) logs.

The follow is:

Client > Load Balancer > Apache httpd server > Tomcat server (running Shibboleth's IdP)

The variable with the Client's IP at the Load Balancer is ClientIP which I can capture in the web server's logs using LogFormat "%{ClientIP}i ... " and similarly in Tomcat's access logs using these inserver.xml`:

<Valve className="org.apache.catalina.valves.RemoteIpValve" 
protocolHeaderHttpsValue="https" />

<Valve className="org.apache.catalina.valves.AccessLogValve" 
pattern="%{ClientIP}i %h %l %u %t %r %>s %b %{Referer}i %{User-Agent}i" resolveHosts="false"/>

Now, I'm looking to capture this IP in Shibboleth's IdP audit logs. This discussion talks about using mod_rpaf for Apache but doesn't get into the details. I'm hoping to do without installing additional modules.

Looks like I'm missing a couple of (small?) pieces here. Any ideas? Many thanks!

share|improve this question

1 Answer 1

up vote 1 down vote accepted

After digging at LogBack's documentation on logging client IPs and the corresponding code for the MDCInsertingServletFilter servlet, turns out you must use the X-Forwarder-For header.

We replaced ClientIP with X-Forwarder-For in the load balancer, updated httpd.conf's LogFormat to log X-Forwarder-For, then updated Shibboleth's logging.xml file as follows for the audit logs:

<appender name="IDP_AUDIT" class="ch.qos.logback.core.rolling.RollingFileAppender">

  <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
  <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">

We made similar changes to the idp-process as well, and did not have to update Tomcat's logging.

Hope this helps others.

Edit 1: Tomcat Logging

Turns out, after a while, the X-Forwarded-For IP address stopped appearing in Shib's IdP logs. We ended up adding the RemoteIpValve in tomcat and restarting. Looks like it is needed after all:

  <Valve className="org.apache.catalina.valves.RemoteIpValve"
   trustedProxies="--IPs here--"
   protocolHeaderHttpsValue="https" />
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.