I'm trying to use Apache's OpenID authentication module. According to this page, I should be able to use the REMOTE_USER Apache variable to identify the user. I'd like to pass this as a header to an upstream application (I'm using Apache to authenticate and reverse-proxy).

My Apache site config is as follows:

<VirtualHost *:80>

  ProxyPass / http://localhost:3000/
  ProxyPassReverse / http://localhost:3000/

  <Location />
    AuthType OpenID
    require valid-user
    AuthOpenIDAXRequire email http://axschema.org/contact/email @muller\.io$
    AuthOpenIDAXUsername email
    RequestHeader set x-username $REMOTE_USER

I've searched and searched, but the most I can find is how to use an environment variable in this context. I've verified that a hard-coded string works (actually the above passes the string "$REMOTE_USER" to my application).

If mod_auth_openid is setting the REMOTE_USER variable within Apache, how can I then pass that upstream to my app?

  • Try replacing $REMOTE_USER with %{REMOTE_USER} – davidgo Apr 17 '14 at 4:36
  • I did try that as well as %{REMOTE_USER}e. The first errored out with Unrecognized header format % on Apache restart, while the second gave (null) in the expected header on my app. – Ryan Kennedy Apr 17 '14 at 4:40
  • The infuriating part is that it correctly rejects emails that aren't from muller.io; I've verified that. The emails just aren't making it to the app! – Ryan Kennedy Apr 17 '14 at 4:42

After digging some more, I found this page with the following code:

 RewriteEngine On
 RewriteCond %{REMOTE_USER} (.+)
 RewriteRule . - [E=RU:%1]
 RequestHeader set REMOTE_USER %{RU}e

This was the magic bullet that fixed it for me. I read some pages that suggest this may be incorrect (and indeed it looks kludgy), so please feel free to recommend something better.

  • Beat me to this post. I was going to recommend something very similar from ruby-forum.com/topic/83067 - This thread also explains why its neccessary. – davidgo Apr 17 '14 at 4:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.