0
I have configured Apache as reverse proxy to my PostGraphile service. My idea is to use Apache to do kerberos authentication and then make PostGraphile service available to authenticated users.
I also need to pass some custom headers to that service.
At this point in time I can have either kerberos authentication turned on or headers passed. As soon as I turn authentication on headers are not appearing on the service side.
This is my vhost config:
<VirtualHost *:80>
<Location />
AuthType Kerberos
AuthName "Kerberos Authentication"
KrbAuthRealsm MY.REALM
KrbServiceName HTTP
BrowseMatch Windows gssapi-no-negotiate
KrbMethodNegotiate on
KrbMethodK5Passwd off
Krb5Keytab /path/to/keytab.keytab
# require valid-user # with this line uncomented headers defined later do not appear on service side
require all granted # with this line uncommented headers defined later do appear on service side however any user can access the service
ProxyPass 'http://my.service:5000'
ProxyPassReverse 'http://my.service:5000'
</Location>
<Proxy *>
Order Deny,Allow
Deny from all
Allow from local.ip.range
</Proxy>
RequestHeader set MYCUSTOMHEADER foo
</VirtualHost>
I'm out of ideas.
I have been reading Apache documentation, auth_mode_kerb documentation, stack threads and blogs but it seems I'm encountering some weird bug here or missing something fundamental...
Any hints would be very welcome