PR: https://github.com/OpenNMS/opennms/pull/1525

Source file as attachment (formatting in comment got messed up)

Brilliant. Thanks, @Neiman Alvarez. We have an OCA on file for you already, so I don't expect many barriers to upstreaming this work.

To add the filter to the Spring security filter chain, I modified the applicationContext-spring-security.xml as follows:

1. Add the following attribute to each <http> tag: servlet-api-provision="false"
2. Add the following custom: filter inside each <http> tag (near the end)

<!-- Added for access logging -->
<custom-filter position="SERVLET_API_SUPPORT_FILTER" ref="securityContextHolderAwareFilter" />

3. Add the following bean definition:

<!-- Enable access log to show the authenticated user -->
<beans:bean id="securityContextHolderAwareFilter" class="org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilterForJetty"/>

Example:

Change from this:
------------------------------------------------------------------------------ <http pattern="/rest/**" realm="OpenNMS Realm">
<!-- OPTIONS pre-flight requests should always be accepted -->
<intercept-url pattern="/rest/**" method="OPTIONS" access="ROLE_ANONYMOUS,ROLE_REST,ROLE_ADMIN,ROLE_USER,ROLE_MOBILE"/>
...
<http-basic />

<custom-filter position="LAST" ref="authFilterEnabler"/>
</http>
------------------------------------------------------------------------------ to this:
------------------------------------------------------------------------------ <http pattern="/rest/**" realm="OpenNMS Realm" servlet-api-provision="false">
<!-- OPTIONS pre-flight requests should always be accepted -->
<intercept-url pattern="/rest/**" method="OPTIONS" access="ROLE_ANONYMOUS,ROLE_REST,ROLE_ADMIN,ROLE_USER,ROLE_MOBILE"/>
...
<http-basic />

<!-- Added for access logging -->
<custom-filter position="SERVLET_API_SUPPORT_FILTER" ref="securityContextHolderAwareFilter" />
<custom-filter position="LAST" ref="authFilterEnabler"/>
</http>
------------------------------------------------------------------------------ (Make the same change for each <http> tag that requires authentication.)

I came up with the following class as a quick and minimally intrusive way to set the authenticated user in the Jetty request log (compiled into a separate jar and copied into opennms/lib directory). The code could definitely use some refinement, as I haven't had time to look into the Jetty documentation to understand all possible edge cases. But it seems to be working fine in our deployments:
------------------------------------------------------------------------------ package org.springframework.security.web.servletapi;

import java.io.IOException;
import java.security.Principal;
import javax.security.auth.Subject;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletRequestWrapper;
import javax.servlet.ServletResponse;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.eclipse.jetty.server.Request;
import org.eclipse.jetty.server.UserIdentity;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;

public class SecurityContextHolderAwareRequestFilterForJetty extends SecurityContextHolderAwareRequestFilter {

private static final Logger LOG = LogManager.getLogger();

public static class UserIdentityStub implements UserIdentity {
private final String userName;
public UserIdentityStub(String userName) {
this.userName = userName;
}
public Subject getSubject() {
// Not implemented
LOG.error("Unexpected call to getSubject()");
return new Subject();
}
public Principal getUserPrincipal() {
return new Principal() {
public String getName() {
return userName;
}
};
}
public boolean isUserInRole(String role, Scope scope) {
// Not implemented
LOG.error("Unexpected call to isUserInRole()");
return false;
}
}

public static class AuthenticationUserStub implements org.eclipse.jetty.server.Authentication.User {
private final String userName;
public AuthenticationUserStub(String userName) {
this.userName = userName;
}
public String getAuthMethod() {
// Not implemented
LOG.error("Unexpected call to getAuthMethod()");
return null;
}
public UserIdentity getUserIdentity() {
return new UserIdentityStub(userName);
}
public boolean isUserInRole(UserIdentity.Scope scope, String role) {
// Not implemented
LOG.error("Unexpected call to isUserInRole()");
return false;
}
public void logout() {
// Not implemented
LOG.error("Unexpected call to logout()");
}
}

@Override
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
final ServletRequest jettyRequest = unwrapRequest(req, 20);
if (jettyRequest instanceof Request) {
final Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
if (authentication != null) {
final String userName = authentication.getName();
((Request) jettyRequest).setAuthentication(new AuthenticationUserStub(userName));
}
} else {
LOG.error("Couldn't access Jetty Request object to log username. Request type is {}",
jettyRequest.getClass().getCanonicalName());
}
super.doFilter(req, res, chain);
}

public ServletRequest unwrapRequest(ServletRequest req, int maxDepth) {
while (req instanceof ServletRequestWrapper) {
if (maxDepth-- <= 0) {
LOG.info("**** max depth reached - couldn't access org.eclipse.jetty.server.Request object");
return req;
}
req = ((ServletRequestWrapper) req).getRequest();
}
return req;
}
}
------------------------------------------------------------------------------