Apache basecontainer doesn't log basic auth username

[baszoetekouw]

The Apache basecontainer uses this logging config:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{X-Real-IP}i\"" openconext
CustomLog /proc/self/fd/1 openconext

The %u there should log the HTTP Basic username. However, that never happens.

For example, when querying Manage:

curl -u foo:bar -v  -X POST --json '{"ALL_ATTRIBUTES":true}' 'https://manage.acc.surfconext.nl/manage/api/internal/search/saml20_sp' -o /dev/null
[...]
> POST /manage/api/internal/search/saml20_sp HTTP/2
> Host: manage.acc.surfconext.nl
> authorization: Basic c3lzYWRtaW46Qlg1bHBpV0pUbUoycnpoQVo=
[...]
< HTTP/2 200
[...]

The log contains:

May 29 15:08:07 docker1.acc.ams.surfconext.nl managegui[773]: 145.100.191.4 - - [29/May/2026:15:08:06 +0200] "POST /manage/api/internal/search/saml20_sp HTTP/1.1" 200 12906216 "-" "curl/7.88.1" "145.100.183.8"

[pmeulen]

%u is only set when Apache handles the authentication. So it is not set when it is the application that handles the authentication.

From https://httpd.apache.org/docs/current/mod/mod_log_config.html:

%u Remote user if the request was authenticated. May be bogus if return status (%s) is 401 (unauthorized).