{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/2718","repository_url":"https://api.github.com/repos/kubernetes/ingress-nginx","labels_url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/2718/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/2718/comments","events_url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/2718/events","html_url":"https://github.com/kubernetes/ingress-nginx/issues/2718","id":336514244,"node_id":"MDU6SXNzdWUzMzY1MTQyNDQ=","number":2718,"title":"there should be a way to include “user name” established during “External Authentication” into the “access log”","user":{"login":"ReneKroon","id":3002872,"node_id":"MDQ6VXNlcjMwMDI4NzI=","avatar_url":"https://avatars0.githubusercontent.com/u/3002872?v=4","gravatar_id":"","url":"https://api.github.com/users/ReneKroon","html_url":"https://github.com/ReneKroon","followers_url":"https://api.github.com/users/ReneKroon/followers","following_url":"https://api.github.com/users/ReneKroon/following{/other_user}","gists_url":"https://api.github.com/users/ReneKroon/gists{/gist_id}","starred_url":"https://api.github.com/users/ReneKroon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ReneKroon/subscriptions","organizations_url":"https://api.github.com/users/ReneKroon/orgs","repos_url":"https://api.github.com/users/ReneKroon/repos","events_url":"https://api.github.com/users/ReneKroon/events{/privacy}","received_events_url":"https://api.github.com/users/ReneKroon/received_events","type":"User","site_admin":false},"labels":[{"id":778120598,"node_id":"MDU6TGFiZWw3NzgxMjA1OTg=","url":"https://api.github.com/repos/kubernetes/ingress-nginx/labels/lifecycle/rotten","name":"lifecycle/rotten","color":"604460","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-06-28T08:01:09Z","updated_at":"2018-11-25T09:40:02Z","closed_at":null,"author_association":"NONE","body":"<!-- Thanks for filing an issue! Before hitting the button, please answer these questions.-->\r\n\r\n**Is this a request for help?** (If yes, you should use our troubleshooting guide and community support channels, see https://kubernetes.io/docs/tasks/debug-application-cluster/troubleshooting/.): N\r\n\r\n**What keywords did you search in NGINX Ingress controller issues before filing this one?** (If you have found any duplicates, you should instead reply there.): I searched for 'user' and then read the titles of all issues.\r\n\r\n---\r\n\r\nFEATURE REQUEST\r\n\r\nWe are trying to make use of “External Authentication” feature in `ingress-nginx`.\r\n \r\nSo far, we’ve got AuthN and AuthZ working.\r\n \r\nNow, we’d like to configure `ingress-nginx` to include “user name” established during “External Authentication” into the “access log”.\r\n \r\nIs it possible in general? How could we do that?\r\n\r\nHere is our configuration:\r\n \r\nIngress resource\r\n \r\napiVersion: extensions/v1beta1\r\nkind: Ingress\r\nmetadata:\r\n  annotations:\r\n    kubernetes.io/ingress.class: internal\r\n    nginx.ingress.kubernetes.io/auth-url: http://authz.example.svc.cluster.local/authZ\r\n    nginx.ingress.kubernetes.io/auth-signin: https://authn.example.org/ \r\n    nginx.ingress.kubernetes.io/auth-response-headers: X-Forwarded-User\r\n \r\nnginx.conf generated by the `ingress-nginx`\r\n \r\nhttp {\r\n  log_format upstreaminfo '$the_real_ip - [$the_real_ip] - $remote_user $upstream_http_x_forwarded_user $authHeader0 [$time_local] \"$request\" $status $body_bytes_sent \"$http_referer\" \"$http_user_agent\" $request_length $request_time   [$proxy_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status';\r\n \r\n  server {\r\n    location / {\r\n# this location requires authentication\r\nauth_request        /_external-auth-Lw;\r\nauth_request_set    $auth_cookie $upstream_http_set_cookie;\r\nadd_header          Set-Cookie $auth_cookie;\r\nauth_request_set $authHeader0 $upstream_http_x_forwarded_user;\r\nproxy_set_header 'X-Forwarded-User' $authHeader0;\r\n    }\r\n  }\r\n}\r\n\r\n\r\n**What happened**:\r\nObserved behavior:\r\nvariable $remote_user is resolved to “-”\r\nvariable $upstream_http_x_forwarded_user is resolved to “” (empty string)\r\nvariable $authHeader0 is resolved to “” (empty string)\r\n\r\n**What you expected to happen**:\r\nthere should be a way to include “user name” established during “External Authentication” into the “access log”\r\n\r\n**How to reproduce it** (as minimally and precisely as possible):\r\nsee config\r\n\r\n**Anything else we need to know**:\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/comments/441427584","html_url":"https://github.com/kubernetes/ingress-nginx/issues/2718#issuecomment-441427584","issue_url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/2718","id":441427584,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MTQyNzU4NA==","user":{"login":"fejta-bot","id":30488982,"node_id":"MDQ6VXNlcjMwNDg4OTgy","avatar_url":"https://avatars1.githubusercontent.com/u/30488982?v=4","gravatar_id":"","url":"https://api.github.com/users/fejta-bot","html_url":"https://github.com/fejta-bot","followers_url":"https://api.github.com/users/fejta-bot/followers","following_url":"https://api.github.com/users/fejta-bot/following{/other_user}","gists_url":"https://api.github.com/users/fejta-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/fejta-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fejta-bot/subscriptions","organizations_url":"https://api.github.com/users/fejta-bot/orgs","repos_url":"https://api.github.com/users/fejta-bot/repos","events_url":"https://api.github.com/users/fejta-bot/events{/privacy}","received_events_url":"https://api.github.com/users/fejta-bot/received_events","type":"User","site_admin":false},"created_at":"2018-11-25T09:40:02Z","updated_at":"2018-11-25T09:40:02Z","author_association":"NONE","body":"Rotten issues close after 30d of inactivity.\nReopen the issue with `/reopen`.\nMark the issue as fresh with `/remove-lifecycle rotten`.\n\nSend feedback to sig-testing, kubernetes/test-infra and/or [fejta](https://github.com/fejta).\n/close"}}
{"actor":{"display_login":"fejta-bot"}}