I have a web app which uses mod_auth for user authentication, however I would like to move to authentication via openid against the google openid provider and use the mod_auth_openid module - http://findingscience.com/mod_auth_openid/
This actually works quite well, in that it is surprisingly transparent drop in replacement.
However the problem is that google is providing the REMOTE_USER environment variables as a URN e.g. (https://www.google.com/accounts/o8/id?id=AItOawnL5MBeLjgzgergqdLcsYNgergwt2ng8@Apache) and the email address as an QUERY_STRING value in the successful redirection to the app.
This is useful for new users, as google is confirming that it is the same user as before, but for existing users I need to have the email in the REMOTE_USER environment variable.
I tried something like the following;
<Location /success>
SetEnvIfNoCase QUERY_STRING "openid.ext1.value.email=(.*)" REMOTE_USER=$1
</Location>
where the browser is redirected to /success?openid.ext1.value.email=tom@example.com but I am not getting any matches, and the REMOTE_USER stays as the URN.
Setting the REMOTE_USER explicitly seems to not work also, so presumably I am missing quite a bit here;
<Location /success>
SetEnv REMOTE_USER "tom@example.com"
</Location>
(Obviously there are limitations to this strategy generally, in that only google and yahoo are actually confirming the ownership of the email address, other openid providers have user entered email addresses, so I am only using google openid for this.)
