Aspnetcore: cs-username not populated in IIS logs

[milkshakeuk]

Describe the bug

We recently converted our Webapi aplication over to AspNetCore.
When hosting an AspNetCore 2.2 and targeting net461 application in IIS the cs-username property of the IIS logs is empty.
When it was using WebApi previously the cs-username field was populated in the IIS logs.

I would have though that the AspNetCore IIS integration would pass this through from the ClaimsIdentity to allow IIS to access this.

To Reproduce

Steps to reproduce the behavior:
Host a aspnet core application with cookie authentication under IIS and check the IIS logs

Expected behavior

I expect that the cs-username field in the iis logs is populated.

Screenshots

If applicable, add screenshots to help explain your problem.

Additional context

IIS version 7.5.7600.16385
Windows Server 2008 R2 Enterprise
.NET Core SDK (reflecting any global.json):
Version: 2.2.101
Commit: 236713b0b7

Runtime Environment:
OS Name: Windows
OS Version: 6.1.7601
OS Platform: Windows
RID: win7-x64
Base Path: C:\Program Files\dotnet\sdk\2.2.101\

Host (useful for support):
Version: 2.2.0
Commit: 1249f08fed

.NET Core SDKs installed:
2.1.4 [C:\Program Files\dotnet\sdk]
2.2.101 [C:\Program Files\dotnet\sdk]

.NET Core runtimes installed:
Microsoft.AspNetCore.All 2.2.0 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
Microsoft.AspNetCore.App 2.2.0 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 2.0.5 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 2.2.0 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]

[milkshakeuk]

This is also the same for windows server 2019 with IIS 10.0.17763.1

[shirhatti]

@Tratcher

[Tratcher]

What kind of auth are you using in the old and new sites? I would only expect something like that to work for windows auth.

[Tratcher]

Nevermind, just saw that part of your report. There's no expectation that this would work with cookie authentication. I'm a little surprised it worked in System.Web.

[milkshakeuk]

It did work before with cookie Auth and now it doesn't, is it wrong to have expected that it should still be there?

We use cs-username for stats on application usage, I don't really want to have to log out every requests again with nlog just to have access to this information.

[Tratcher]

What cookie auth implemetation were you using? Microsoft.Owin was the most recent implementation I'm familiar with.

[milkshakeuk]

@Tratcher technically it was what ever the last version of WebApi was available when using the old Global.asax and we were using Forms Authentication which used cookies.

[Tratcher]

Ok, turning this back over to @shirhatti as a feature request. In the meantime you're going to have to use AspNetCore logging to get what you're looking for.

[muratg]

We do not plan to implement this.

[milkshakeuk]

@Tratcher, @muratg

In the end we added a custom username header to all responses then created custom IIS log fields which plucked it from the response headers to get what we needed into the IIS logs. Not ideal but it works.

It's a shame you don't plan on implementing this since it did used to "just work".