Template requestAttributesEnabled on the Log4j ConfigurableLoggerAccessLogValve

[PasinduYeshan]

Purpose

Follow-up to #27655. That PR templated requestAttributesEnabled on the default AccessLogValve (the {% else %} branch) but left the Log4j ConfigurableLoggerAccessLogValve branch ({% if http_access_log.useLogger is sameas true %}) emitting only pattern — so http_access_log.request_attributes_enabled is silently dropped when the Log4j access logger is used.

When IS is behind a reverse proxy with RemoteIpValve, the %h pattern cannot log the real client IP because requestAttributesEnabled is never propagated to the Log4j valve.

Fixes #27172.

Change

modules/distribution/src/repository/resources/conf/templates/repository/conf/tomcat/catalina-server.xml.j2 — added requestAttributesEnabled="{{http_access_log.request_attributes_enabled}}" to the ConfigurableLoggerAccessLogValve element, mirroring the default-valve branch from #27655.

• No JAR change — ConfigurableLoggerAccessLogValve extends AbstractAccessLogValve and already honors the attribute.
• No default.json change — http_access_log.request_attributes_enabled (default false) was added in Template the requestAttributesEnabled parameter for the AccessLogValve #27655.
• Reuses the existing knob. No new configuration property.

Opt-in (requires restart)

[http_access_log]
useLogger = true
request_attributes_enabled = true

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 1dfddc68-82d2-477b-899f-3e06b5399c8f

📥 Commits

Reviewing files that changed from the base of the PR and between 0bc9140 and 24db0fe.

📒 Files selected for processing (1)

• modules/distribution/src/repository/resources/conf/templates/repository/conf/tomcat/catalina-server.xml.j2

---

📝 Walkthrough

Summary

This PR completes the templating of the requestAttributesEnabled attribute for Tomcat's Access Log configuration. The change adds the missing requestAttributesEnabled="{{http_access_log.request_attributes_enabled}}" attribute to the ConfigurableLoggerAccessLogValve element (used when http_access_log.useLogger is enabled), bringing it into parity with the standard AccessLogValve configuration.

What changed

Modified catalina-server.xml.j2 to configure the requestAttributesEnabled parameter for the Log4j-based ConfigurableLoggerAccessLogValve. This enables the valve to use request attributes for logging, which is required for proper client IP detection when used with Tomcat's RemoteIpValve in reverse proxy scenarios.

Why it matters

When Identity Server is deployed behind a reverse proxy with RemoteIpValve enabled, the access log now correctly captures the real client IP address instead of the proxy's IP. The valve will now properly utilize request attributes set by RemoteIpValve to populate the client IP in log patterns.

Technical details

• No JAR or code changes required; ConfigurableLoggerAccessLogValve already supports this attribute
• Reuses the existing http_access_log.request_attributes_enabled configuration setting (default: false)
• Allows users to enable request attributes logging by setting request_attributes_enabled = true in their [http_access_log] configuration section alongside useLogger = true

Walkthrough

In catalina-server.xml.j2, the template block for ConfigurableLoggerAccessLogValve (rendered when http_access_log.useLogger is enabled) is extended to emit the requestAttributesEnabled attribute, sourced from the http_access_log.request_attributes_enabled template variable. Previously, only the pattern attribute was emitted in this block. No other files or exported entities are changed.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically identifies the main change: adding requestAttributesEnabled templating to the Log4j ConfigurableLoggerAccessLogValve.
Description check	✅ Passed	The description provides context for the change, references the related issue and previous PR, explains the problem and solution, and confirms no new dependencies or configuration properties are introduced.
Linked Issues check	✅ Passed	The PR directly addresses the requirements from #27172 by templating the requestAttributesEnabled attribute for the Log4j ConfigurableLoggerAccessLogValve, enabling proper client IP logging behind reverse proxies.
Out of Scope Changes check	✅ Passed	All changes are scoped to the single templating modification required to fix #27172; no extraneous modifications to JAR files, configuration defaults, or other unrelated components.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[PasinduYeshan]

Integration Test Runner
https://github.com/PasinduYeshan/product-is/actions/runs/27751138467

[PasinduYeshan]