2 files changed, 21 insertions, 4 deletions
diff --git a/container-accesslogging/src/main/java/com/yahoo/container/logging/AccessLogEntry.java b/container-accesslogging/src/main/java/com/yahoo/container/logging/AccessLogEntry.java
index 9120c747293..24078151d64 100644
--- a/container-accesslogging/src/main/java/com/yahoo/container/logging/AccessLogEntry.java
+++ b/container-accesslogging/src/main/java/com/yahoo/container/logging/AccessLogEntry.java
@@ -4,6 +4,7 @@ package com.yahoo.container.logging;
 import com.yahoo.collections.ListMap;
 import org.apache.commons.lang.builder.ReflectionToStringBuilder;
 
+import javax.security.auth.x500.X500Principal;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
 import java.net.URI;
@@ -94,6 +95,7 @@ public class AccessLogEntry {
     private String scheme;
     private int localPort;
     private Principal principal;
+    private X500Principal sslPrincipal;
 
     private ListMap<String,String> keyValues=null;
 
@@ -724,6 +726,19 @@ public class AccessLogEntry {
         }
     }
 
+    public Principal getSslPrincipal() {
+        synchronized (monitor) {
+            return sslPrincipal;
+        }
+    }
+
+    public void setSslPrincipal(X500Principal sslPrincipal) {
+        synchronized (monitor) {
+            requireNull(this.sslPrincipal);
+            this.sslPrincipal = sslPrincipal;
+        }
+    }
+
     @Override
     public String toString() {
         synchronized (monitor) {
diff --git a/container-accesslogging/src/main/java/com/yahoo/container/logging/JSONFormatter.java b/container-accesslogging/src/main/java/com/yahoo/container/logging/JSONFormatter.java
index cca8da2e936..a8be7c5ed13 100644
--- a/container-accesslogging/src/main/java/com/yahoo/container/logging/JSONFormatter.java
+++ b/container-accesslogging/src/main/java/com/yahoo/container/logging/JSONFormatter.java
@@ -65,10 +65,12 @@ public class JSONFormatter {
 
             Principal principal = accessLogEntry.getUserPrincipal();
             if (principal != null) {
-                generator.writeObjectFieldStart("user-principal");
-                generator.writeStringField("name", principal.getName());
-                generator.writeStringField("type", principal.getClass().getName());
-                generator.writeEndObject();
+                generator.writeStringField("user-principal", principal.getName());
+            }
+
+            Principal sslPrincipal = accessLogEntry.getSslPrincipal();
+            if (sslPrincipal != null) {
+                generator.writeStringField("ssl-principal", principal.getName());
             }
 
             // Only add remote address/port fields if relevant