Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Using Apache 2.2 on Windows with mod_auth_sspi and mod_headers. I'm trying to pass the current authenticated user through to the proxy target in the X-Remote-User header.

I expect that this is simple, but I've been wrangling Apache for an hour now and can't find the secret sauce in documentation or google.

My configuration is as follows. It correctly authenticates the user with Active Directory, and then proxies the request through to the server sitting behind. However, the X-Remote-User header doesn't get added. It appears that the REMOTE_USER environment variable doesn't exist. Neither does AUTH_USER.

I know that the authenticated username is available somewhere, but how do I get it?

ProxyRequests off
ProxyPass /clsoap/ http://127.0.0.1:12001/clsoap/

<Location /clsoap/>
    ProxyPassReverse /clsoap/

    AuthName "ADTest"
    AuthType SSPI
    SSPIAuth On
    SSPIAuthoritative On
    SSPIDomain primary.example.com
    SSPIUsernameCase lower
    SSPIOfferBasic Off
    Require valid-user

    RequestHeader set X-Remote-User "%{REMOTE_USER}e" env=REMOTE_USER
    RequestHeader set X-Auth-User "%{AUTH_USER}e" env=AUTH_USER
</Location>
share|improve this question
up vote 6 down vote accepted

Yay. Another google session later trying different random keywords and I found this:

http://www.ruby-forum.com/topic/83067

http://old.nabble.com/Forcing-a-proxied-host-to-generate-REMOTE_USER-to2911573.html#a2914465

This now works:

ProxyRequests off
ProxyPass /clsoap/ http://127.0.0.1:12001/clsoap/

<Location /clsoap/>
    ProxyPassReverse /clsoap/

    AuthName "ADTest"
    AuthType SSPI
    SSPIAuth On
    SSPIAuthoritative On
    SSPIDomain primary.example.com
    SSPIUsernameCase lower
    SSPIOfferBasic Off
    Require valid-user

    RewriteEngine On
    RewriteCond %{LA-U:REMOTE_USER} (.+)
    RewriteRule . - [E=RU:%1]
    RequestHeader set X-Remote-User "%{RU}e" env=RU
</Location>
share|improve this answer
    
That rewrite rule for me ran into nesting problems described at fossplanet.com/f16/…. RewriteRule . - [E=RU:%1,NS] fixed it. – lkraav Aug 8 '11 at 11:06
    
@brofield using this rewrite rule you will get SamAccountName. But how to get UserPrincipalName? Thanks! – Yoldar-Zi May 8 '15 at 10:55

I know this is an ancient post but since users still hit this I thought I would add that there is a world of difference in which variables are available in ssl environment "%{VAR}s" vs the non-ssl environment %{VAR}e

I found that pubcookie set the remote user only as a secure environment variable which I could forward via the following:

    RequestHeader set X-REMOTE-USER %{REMOTE_USER}s

NOTE: ends in s not in e!

Now this can be a potential security hole that leaks username information to hackers if you ever forward requests to other servers or use http. I only forward to localhost personally so this is not an issue for me.

share|improve this answer
    
The only working solution for me from way too much options I tried, thanks so much! I have httpd as a reverse proxy (with Kerberos connected to AD), forwarding HTTPS requests to Tomcat, on AIX LPAR. – mikiqex Jan 27 at 12:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.