1

I'm trying to use Apache's OpenID authentication module. According to this page, I should be able to use the REMOTE_USER Apache variable to identify the user. I'd like to pass this as a header to an upstream application (I'm using Apache to authenticate and reverse-proxy).

My Apache site config is as follows:

<VirtualHost *:80>

  ProxyPass / http://localhost:3000/
  ProxyPassReverse / http://localhost:3000/

  <Location />
    AuthType OpenID
    require valid-user
    AuthOpenIDAXRequire email http://axschema.org/contact/email @muller\.io$
    AuthOpenIDAXUsername email
    RequestHeader set x-username $REMOTE_USER
  </Location>
</VirtualHost>

I've searched and searched, but the most I can find is how to use an environment variable in this context. I've verified that a hard-coded string works (actually the above passes the string "$REMOTE_USER" to my application).

If mod_auth_openid is setting the REMOTE_USER variable within Apache, how can I then pass that upstream to my app?

Ryan Kennedy
  • 203
  • 2
  • 11
  • Try replacing $REMOTE_USER with %{REMOTE_USER} – davidgo Apr 17 '14 at 04:36
  • I did try that as well as `%{REMOTE_USER}e`. The first errored out with `Unrecognized header format %` on Apache restart, while the second gave `(null)` in the expected header on my app. – Ryan Kennedy Apr 17 '14 at 04:40
  • The infuriating part is that it correctly rejects emails that aren't from `muller.io`; I've verified that. The emails just aren't making it to the app! – Ryan Kennedy Apr 17 '14 at 04:42

1 Answers1

1

After digging some more, I found this page with the following code:

 RewriteEngine On
 RewriteCond %{REMOTE_USER} (.+)
 RewriteRule . - [E=RU:%1]
 RequestHeader set REMOTE_USER %{RU}e

This was the magic bullet that fixed it for me. I read some pages that suggest this may be incorrect (and indeed it looks kludgy), so please feel free to recommend something better.

Ryan Kennedy
  • 203
  • 2
  • 11
  • Beat me to this post. I was going to recommend something very similar from https://www.ruby-forum.com/topic/83067 - This thread also explains why its neccessary. – davidgo Apr 17 '14 at 04:58