Capture real client IP address (e.g. X-Forwarded-For) in Logging

Question

I have deployed Adaxes on an internal network and use a Microsoft AD FS Web Application Proxy to publish the web interface to external networks. After reviewing the Logging in the Adaxes Administration Console, I noticed that the IP address of the Web Application Proxy is captured instead of the real client IP address.

As a result, log entries always take the following form:

Sign in to Web Interface Common Sign In from <IP address of AD FS WAP>

The Installation Guide documents using an "application delivery controller" to make the Web Interface accessible from outside the local network.

I have verified that the AD FS Web Application Proxy is correctly setting the X-Forwarded-For HTTP header, and that IIS is able to capture the X-Forwarded-For header with custom logging after referenceing this Microsoft Tech Community article.

Is it possible to configure Adaxes to log the external IP address?

Answer 1

Hello,

Unfortunately, there is no such possibility.

Comments

Thank you for the quick answer.

Accurate logging is important for security, compliance, and troubleshooting. The Installation Guide is misleading since it states the following as supported:

If you do not want to install a read-only domain controller and Adaxes Web Interface in the DMZ, but still need to make Web Interface accessible from outside, you can use an application delivery controller (e.g. Citrix NetScaler, Nginx, CloudFare, etc.). For example, the controller can be placed in the DMZ to accept requests from outside and pass them to the Adaxes Web Interface installed in your local network.

Could you please:

1. Consider this question a feature request for accurate logging
2. Update the Installation Guide with a warning in the above excerpt so that people will be aware of the logging inaccuracy if they choose that deployment topology

---

Hello,

Thank you for the suggestions, we will consider them.

---

Was this ever implemented?

A common implementation is to only support/trust the header from certain IP addresses (the trusted reverse proxies).

Unfortunately, this feature is needed for any higher security environment using reverse proxy layer-7 web application firewalls, something particularly important to use when using sensitive systems like Adaxes.

---

Hello,

Unfortunately, the feature is not available in the latest version of Adaxes. However, we are considering it for future releases.