[mod-security-users] Custom Headers

[Matt W. <mat...@ho...>]

I am hoping this is a relatively straight forward question, but I have been struggling with it for some time and cannot find any examples online.

We are using ModSecurity 3.04 with NGINX and trying to get a custom header written to the audit log with every transaction. Essentially, we want to write the $ssl_client_s_dn_cn variable to the audit log which is populated by the users PKI certificate when they login through a reverse proxy. This info is set in a header to available to applications so if you had something similar to:

proxy_set_header ClientUsername $ssl_client_s_dn_cn.

How would you craft a modsec rule to write client username to the audit log?

Thanks in advance,

Matt