java - 使用 Spring Security 时，Tomcat 访问日志中缺少用户 (%u)

Question

我在 Apache Tomcat 8 中运行一个示例 Spring Security (hello world) Web 应用程序。我想查看的是 Tomcat 访问日志中的用户信息，但看起来该信息不存在。访问日志条目示例:

0:0:0:0:0:0:0:1 - - [06/Nov/2019:09:41:57 +0200] "GET / HTTP/1.1" 200 422
0:0:0:0:0:0:0:1 - - [06/Nov/2019:09:41:59 +0200] "GET /hello HTTP/1.1" 200 83

Tomcat server.xml中的访问日志配置为:

<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
           prefix="localhost_access_log" suffix=".txt"
           pattern="common" />

pattern="common" 对应于由 '%h %l %u %t "%r"%s %b' 定义的通用日志格式，如其描述 here . Tomcat 文档还指出:

%u - Remote user that was authenticated (if any), else '-'

我是否应该应用任何其他配置来使用户在访问日志中可见？

Answer 1

作为answered , 它可能无法按预期工作

Tomcat's access log valve, this won't work, since Tomcat is unaware of Spring Security, which operates entirely within your application.

您可以使用过滤器:

The easiest option would be to just add your own filter (e.g. in web.xml) after Spring Security, and dump the information you want

其他解决方案suggested in Config9 ，您可能需要将用户名作为 session 属性包含在内

Possibly this is not sufficient as common pattern already contains %u parameter. In this case I would recommend two additional steps:

1) Put user’s name into request session parameter, something like:

request.getSession().addAttribute("username", user.getName());

2) Add following parameter in access log pattern: %{username}s

server.tomcat.accesslog.pattern=%h %l %t %u %{username}s "%r" %s %b