{"action":"created","issue":{"url":"https://api.github.com/repos/floragunncom/search-guard/issues/292","repository_url":"https://api.github.com/repos/floragunncom/search-guard","labels_url":"https://api.github.com/repos/floragunncom/search-guard/issues/292/labels{/name}","comments_url":"https://api.github.com/repos/floragunncom/search-guard/issues/292/comments","events_url":"https://api.github.com/repos/floragunncom/search-guard/issues/292/events","html_url":"https://github.com/floragunncom/search-guard/issues/292","id":206008187,"number":292,"title":"Proxy auth generates xff messages when used with basic auth","user":{"login":"dachenbach","id":19396787,"avatar_url":"https://avatars.githubusercontent.com/u/19396787?v=3","gravatar_id":"","url":"https://api.github.com/users/dachenbach","html_url":"https://github.com/dachenbach","followers_url":"https://api.github.com/users/dachenbach/followers","following_url":"https://api.github.com/users/dachenbach/following{/other_user}","gists_url":"https://api.github.com/users/dachenbach/gists{/gist_id}","starred_url":"https://api.github.com/users/dachenbach/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dachenbach/subscriptions","organizations_url":"https://api.github.com/users/dachenbach/orgs","repos_url":"https://api.github.com/users/dachenbach/repos","events_url":"https://api.github.com/users/dachenbach/events{/privacy}","received_events_url":"https://api.github.com/users/dachenbach/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":11,"created_at":"2017-02-07T20:41:43Z","updated_at":"2017-02-13T10:40:32Z","closed_at":null,"body":"I have enabled proxy authentication in sg_config.yml for use with SSO, but I still have basic authentication enabled for role account access (e.g. logstash, kibana, etc.). With both enabled, this message repeats several times a second in the elasticsearch log:\r\n\r\n`[2017-02-07T20:03:58,584][INFO ][c.f.s.a.BackendRegistry  ] ElasticsearchSecurityException[xff not done] extracting credentials from ElasticsearchSecurityException[xff not done]`\r\n\r\nPresumably it's doing this every time a role account authenticates.\r\n\r\nHere is my sg_config.yml:\r\n\r\n```searchguard:\r\n  dynamic:\r\n    http:\r\n      anonymous_auth_enabled: false\r\n      xff:\r\n        enabled: true\r\n        remoteIpHeader:  'x-forwarded-for'\r\n        proxiesHeader:   'x-forwarded-by'\r\n        trustedProxies: '10\\.185\\.25(\\d)?\\.\\d+'\r\n    authc:\r\n      basic_internal_auth_domain:\r\n        enabled: true\r\n        order: 2\r\n        http_authenticator:\r\n          type: basic\r\n          challenge: true\r\n        authentication_backend:\r\n          type: intern\r\n      proxy_auth_domain:\r\n        enabled: true\r\n        order: 1\r\n        http_authenticator:\r\n          type: proxy\r\n          challenge: false\r\n          config:\r\n            user_header: \"X-Forwarded-User\"\r\n            roles_header: \"x-proxy-roles\"\r\n        authentication_backend:\r\n          type: noop\r\n```\r\n\r\nBoth authentication methods work aside from all the log messages."},"comment":{"url":"https://api.github.com/repos/floragunncom/search-guard/issues/comments/279351112","html_url":"https://github.com/floragunncom/search-guard/issues/292#issuecomment-279351112","issue_url":"https://api.github.com/repos/floragunncom/search-guard/issues/292","id":279351112,"user":{"login":"faxm0dem","id":112638,"avatar_url":"https://avatars.githubusercontent.com/u/112638?v=3","gravatar_id":"","url":"https://api.github.com/users/faxm0dem","html_url":"https://github.com/faxm0dem","followers_url":"https://api.github.com/users/faxm0dem/followers","following_url":"https://api.github.com/users/faxm0dem/following{/other_user}","gists_url":"https://api.github.com/users/faxm0dem/gists{/gist_id}","starred_url":"https://api.github.com/users/faxm0dem/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/faxm0dem/subscriptions","organizations_url":"https://api.github.com/users/faxm0dem/orgs","repos_url":"https://api.github.com/users/faxm0dem/repos","events_url":"https://api.github.com/users/faxm0dem/events{/privacy}","received_events_url":"https://api.github.com/users/faxm0dem/received_events","type":"User","site_admin":false},"created_at":"2017-02-13T10:40:32Z","updated_at":"2017-02-13T10:40:32Z","body":"I'm using syslog-ng to do that kind of thing. But I'll investigate of it's possible using log4j2 only."}}
{"actor":{"display_login":"faxm0dem"}}