Problem

Some use cases in API Manager are required to have the event log service context field different from the defaults. Particularly client=application ID and subject=to the user who connects to the application. Both fields in 7.5.3 SP11 and before are set the same value from the ${authentication.subject.id}

Resolution

There is a workaround which will allow the "client" value to be set. It requires the execution of a cURL Command and the addition of a "Set Attribute Filter" in Policy Studio.

Generate and Execute the cURL Command:

1. Open "Developer Tools" in Chrome or Firefox.
2. Generate cURL command: In API Manager navigate to the "Frontend API" > Select an API > "API" tab > Edit the "API name" > "Apply" > revert the change to the "API Name" > "Apply"
3. In "Developer Tools" > "Network" tab, Right-Click the PUT request for ...api/portal/v1.3/proxies/ {id} corresponding to the API Id you are updating > "Copy" > "Copy as cURL"
4. Amend the inboundProfiles > _default > monitorSubject value from "authorization.subject.id" value to one of your choice e.g. "client.app.id"
5. Execute the cURL command to update the Virtualized API.
6. In API Manger "Frontend API" grid, click "Refresh".

Add the Attribute Filter to the Policy in Policy Studio:

1. Policy Studio > select the policy called by the API Manager API > Add "Set Attribute Filter"
2. "Attribute Name" = client.app.id (The name was used for monitorSubject above)
3. "Attribute Value" = ${rest.getApplication().id} (For the Application Id, or an alternative)
4. Finish and Deploy to the gateway.

The Service Context "Client" field in the event log will now be populated with the Application Id or whatever value is set in the "Set Attribute Filter". This will only need to be performed once for each Virtualised API.

{"type":"transaction", "time":1567524041001, "path":"/abc/a", "protocol":"https", "protocolSrc":"8065", "duration":256, "status":"success", "serviceContexts":[
{"service":"My API", "monitor":true, "client":"d2c3e90c-261a-400c-b873-c5662d007efb", "org":null, "app":null, "method":"method", "status":"success", "duration":190}
], "customMsgAtts":{}, "correlationId":"c8846e5d160095a1baac0551", "legs":[
{"uri":"/abc/a", "status":200, "statustext":"OK", "method":"GET", "vhost":null, "wafStatus":0, "bytesSent":403, "bytesReceived":171, "remoteName":"10.0.2.15", "remoteAddr":"10.0.2.15", "localAddr":"172.17.0.1", "remotePort":"60246", "localPort":"8065", "sslsubject":null, "leg":0, "timestamp":1567524040743, "duration":258, "serviceName":"My API", "subject":"filips", "operation":"method", "type":"http", "finalStatus":"Pass"}
,
{"uri":"/healthcheck/abc/a", "status":200, "statustext":"OK", "method":"GET", "vhost":null, "wafStatus":0, "bytesSent":260, "bytesReceived":323, "remoteName":"172.17.0.1", "remoteAddr":"172.17.0.1", "localAddr":"172.17.0.1", "remotePort":"8080", "localPort":"38476", "sslsubject":null, "leg":1, "timestamp":1567524040955, "duration":37, "serviceName":"My API", "subject":"filips", "operation":"method", "type":"http", "finalStatus":null}
]}

Note that this issue is being changed in 7.5.3 SP12 with RDAPI-17007

Issue: Event logging for API Manager was incorrectly overwriting the Application Id in the Service Context "client" field. Resolution: API Manager no longer overwrites the Service Context "client" field from it's initial value.