[Christian – I hoped that was the case – otherwise I was very confused!]

Hi Maher,

There is currently one scenario where the username does get logged – when someone is using ‘Basic Auth’.

I’ve had a quick review of the code, and for that specific case, this line that adds the username to the Apache request object, which then gets logged to the Apache access log file:

https://github.com/eprints/eprints3.4/blob/13690e736eaed14002ebcfea97ecf68ee897c78f/perl_lib/EPrints/Apache/Auth.pm#L292

A similar addition to the ‘auth_cookie’ method (https://github.com/eprints/eprints3.4/blob/13690e736eaed14002ebcfea97ecf68ee897c78f/perl_lib/EPrints/Apache/Auth.pm#L182 ) would additional usernames when auth is done via cookies.

sub auth_cookie

{

    my( $r, $repository ) = @_;

    my $user = $repository->current_user;

   if( defined $user ){

        $r->user( $user->get_value( "username" ) );

    }

…[rest of method unchanged]

This won’t log the user for some /cgi/ pages – where the user isn’t tested/authenticated.

An EPrints rewrite trigger also seems to work:

https://gist.github.com/jesusbagpuss/fb4c01825f5da53ac5ddb2d6a6fa69d3 (see note at top of file as to where to save it)

If you go down this route, you don’t need to make the addition to the EPrints::Apache::Auth module.

Please note, I haven’t thoroughly tested the above code, but initial experiments appear OK. Please run on a test server first!

Any questions, please ask here! 😊

Cheers,

John