How Tomcat is Picking remote user that was authenticated

Question

If i enable tomcat access logs through logback as below

logback.access:
  enabled: true

compile group: 'net.rakugakibox.spring.boot', name: 'logback-access-spring-boot-starter', version: '2.5.0'

configuration as below

<configuration>
    <property name="LOG_HOME" value="${LOG_FILE_LOCATION:-/var/log/RSP}/${HOST_NAME}}"/>
    <appender name="ACCESS" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <File>${LOG_HOME}/reservation_access.log</File>
        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
            <fileNamePattern>${LOG_HOME}/reservation_access-%d{yyyy-MM-dd}.%i.log</fileNamePattern>
            <timeBasedFileNamingAndTriggeringPolicy class="ch.qos.logback.core.rolling.SizeAndTimeBasedFNATP">
                <maxFileSize>5MB</maxFileSize>
            </timeBasedFileNamingAndTriggeringPolicy>
        </rollingPolicy>
        <encoder>
            <pattern>%h %l %u [%{TraceId}i] %t "%r" %s %b %D</pattern>
        </encoder>
    </appender>
    <appender-ref ref="ACCESS" />

</configuration>

it's working fine, but i am not able to understand how it is picking %u, in documentation it's mentioned as Remote user that was authenticated so how tomcat knows who is authenticated user or can any one provide the source code of how these access logs will be generated.(i have gone through the basic article what is Access Log Valve)

And if i enable access logs by using spring boot properties as below

server.tomcat.accesslog.pattern: '%h %l %u [%{TraceId}i] %t "%r" %s %b %D'
server.tomcat.accesslog.prefix: reservation_access
server.tomcat.accesslog.enabled: true
server.tomcat.accesslog.directory: /var/log/RSP/
server.tomcat.accesslog.suffix: .log

then %u is not working,

so what is difference between these two versions?
when access logs will be printed for each request i.e after executing all filters or as soon as the request reaches to server it will be printed ?

Thanks

Evidently Tomcat logging is happening before Spring Security's `SecurityContextHolderAwareRequestFilter` decorates the request . See https://stackoverflow.com/a/31350895/225217 — Brice Roncace, Dec 06 '22 at 21:55

score 0 · Answer 1 · answered Nov 28 '17 at 16:29

0

logback-access-spring-boot-starter reads the value for %u from HttpServletRequest#getRemoteUser().

In the Spring world HttpServletRequest.remoteUser() will typically be populated by Spring Security.

answered Nov 28 '17 at 16:29

glytching

44,936
9
114
120

then in that case if i enable using this property `server.tomcat.accesslog.enabled: true` when %u is not coming ? – prasad Nov 28 '17 at 16:43
Perhaps `HttpServletRequest.remoteUser` is not populated. – glytching Nov 28 '17 at 17:21

How Tomcat is Picking remote user that was authenticated

1 Answers1