WSGI/Django: pass username back to Apache for access log

Question

My Django app, deployed in mod_wsgi under Apache using Django's standard WSGIHandler, authenticates users via form login on the Django side. So to Apache, the user is anonymous. This makes the Apache access log less useful.

Is there a way to pass the username back through the WSGI wrapper to Apache after handling the request, so that it appears in the Apache access log?

(Versions: Django 1.1.1, mod_wsgi 2.5, Apache 2.2.9)

Answer 1

This probably isn't what you're expecting, but you could use the username in your URL scheme. That way the user will be in the path section of your apache logs.

You'd need to modify your authentication so that auth-required responses are obvious in the apache logs, otherwise when viewing the logs you may attribute unauthenticated requests to authenticated users. E.g. return a temporary redirect to the login page if the request isn't authenticated.

Answer 2

You can only do it if using embedded mode and only if you use a separate package called apswigpy, which provides a Python binding for original Apache request object. The mod_wsgi package provides an optional mechanism for allowing original Apache request object to be passed as Python CObject reference in WSGI environment. You use that in conjunction with apswigpy something like:

from apache.httpd import request_rec
r = request_rec(environ['apache.request_rec'])
r.user = user

At least I think that will setup the appropriate information which access logging can then use.

You should really take this discussion over to the mod_wsgi mailing list.

Answer 3

You could use mod_auth_tkt. An auth_tkt is a signed cookie with the user id that Apache can understand. Your web application would have to set the cookie when the user logs in and out. Apache can derive a REMOTE_USER from the cookie, pass it to your web app or a non-Django web application running on the same server, include it in logs, whatever.