You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Terry Cooper <te...@sympatico.ca> on 2013/01/13 15:47:48 UTC
[users@httpd] Passing proxy authentication user name
I am currently attempting to migrate an existing system which is built on
the Sun web proxy server and the Sun web server to the Apache web server.
The proxy portion will remain on Sun until proxy appliances are obtained and
installed, so all I'm dealing with now is the move to Apache HTTPD.
The current system has user access control that is completely based on the
proxy server and acls therein. This means that users log into the proxy, but
there is no login requirement on the web servers. There are a number of cgi
scripts which need to get the user name to operate correctly. Currently the
environment variable HTTP_PROXY_AUTHORIZATION is used to obtain this
information, however from what I can find this is not passed by Apache to
the scripts. I understand the security issue with this as it contains the
password as well, which I don't need. Is there a way to get at least the
user name that is passed by the proxy server.
I'm sure I'm missing something simple here, but I just can't seem to find
it.
Thanks,
Terry
Re: [users@httpd] Passing proxy authentication user name
Posted by Igor Cicimov <ic...@gmail.com>.
On Mon, Jan 14, 2013 at 10:01 AM, Igor Cicimov <ic...@gmail.com> wrote:
>
>
>
> On Mon, Jan 14, 2013 at 9:47 AM, Igor Cicimov <ic...@gmail.com> wrote:
>
>> On Mon, Jan 14, 2013 at 8:10 AM, Igor Cicimov <ic...@gmail.com> wrote:
>>
>>>
>>> On 14/01/2013 1:48 AM, "Terry Cooper" <te...@sympatico.ca> wrote:
>>> >
>>> > I am currently attempting to migrate an existing system which is built
>>> on the Sun web proxy server and the Sun web server to the Apache web
>>> server. The proxy portion will remain on Sun until proxy appliances are
>>> obtained and installed, so all I’m dealing with now is the move to Apache
>>> HTTPD.
>>> >
>>> >
>>> >
>>> > The current system has user access control that is completely based on
>>> the proxy server and acls therein. This means that users log into the
>>> proxy, but there is no login requirement on the web servers. There are a
>>> number of cgi scripts which need to get the user name to operate correctly.
>>> Currently the environment variable HTTP_PROXY_AUTHORIZATION is used to
>>> obtain this information, however from what I can find this is not passed by
>>> Apache to the scripts. I understand the security issue with this as it
>>> contains the password as well, which I don’t need. Is there a way to get at
>>> least the user name that is passed by the proxy server.
>>> >
>>> >
>>> >
>>> > I’m sure I’m missing something simple here, but I just can’t seem to
>>> find it.
>>> >
>>> >
>>> >
>>> > Thanks,
>>> >
>>> >
>>> >
>>> > Terry
>>>
>>> Set a header maybe?
>>>
>>> RequestHeader append Proxy-Authorization
>>>
>> I mean there is already Authorization request header set why not using it?
>>
>>
> I remember mod_rewrite has lookahead option that look slike this:
>
> <snip>
>
> %{LA-U:variable} can be used for look-aheads which perform an internal
> (URL-based) sub-request to determine the final value of *variable*. This
> can be used to access variable for rewriting which is not available at the
> current stage, but will be set in a later phase.
>
> For instance, to rewrite according to the REMOTE_USER variable from
> within the per-server context (httpd.conf file) you must use
> %{LA-U:REMOTE_USER} - this variable is set by the authorization phases,
> which come *after* the URL translation phase (during which mod_rewrite
> operates).
>
> </snip>
> So would say you can use this in a rewrite rule to pass on the REMOTE_USER
> in the query string for example by using the QSA flag and proxying to the
> backend in the same time:
>
> RewriteCond %{LA-U:REMOTE_USER} (.*)
> RewriteRule ^/something.html something.jsp?userid=%{LA-U:REMOTE_USER}
> [QSA,P,L]
>
> Just an idea and completely untested. Hope someone will correct me in case
> I'm talking gibberish here ....
>
> Ooops missed the fact that the Proxy is Sun proxy and not apache one so
all my comments about setting a header or query string are pretty useless.
Sorry for the confusion.
Re: [users@httpd] Passing proxy authentication user name
Posted by Igor Cicimov <ic...@gmail.com>.
On Mon, Jan 14, 2013 at 9:47 AM, Igor Cicimov <ic...@gmail.com> wrote:
> On Mon, Jan 14, 2013 at 8:10 AM, Igor Cicimov <ic...@gmail.com> wrote:
>
>>
>> On 14/01/2013 1:48 AM, "Terry Cooper" <te...@sympatico.ca> wrote:
>> >
>> > I am currently attempting to migrate an existing system which is built
>> on the Sun web proxy server and the Sun web server to the Apache web
>> server. The proxy portion will remain on Sun until proxy appliances are
>> obtained and installed, so all I’m dealing with now is the move to Apache
>> HTTPD.
>> >
>> >
>> >
>> > The current system has user access control that is completely based on
>> the proxy server and acls therein. This means that users log into the
>> proxy, but there is no login requirement on the web servers. There are a
>> number of cgi scripts which need to get the user name to operate correctly.
>> Currently the environment variable HTTP_PROXY_AUTHORIZATION is used to
>> obtain this information, however from what I can find this is not passed by
>> Apache to the scripts. I understand the security issue with this as it
>> contains the password as well, which I don’t need. Is there a way to get at
>> least the user name that is passed by the proxy server.
>> >
>> >
>> >
>> > I’m sure I’m missing something simple here, but I just can’t seem to
>> find it.
>> >
>> >
>> >
>> > Thanks,
>> >
>> >
>> >
>> > Terry
>>
>> Set a header maybe?
>>
>> RequestHeader append Proxy-Authorization
>>
> I mean there is already Authorization request header set why not using it?
>
>
I remember mod_rewrite has lookahead option that look slike this:
<snip>
%{LA-U:variable} can be used for look-aheads which perform an internal
(URL-based) sub-request to determine the final value of *variable*. This
can be used to access variable for rewriting which is not available at the
current stage, but will be set in a later phase.
For instance, to rewrite according to the REMOTE_USER variable from within
the per-server context (httpd.conf file) you must use %{LA-U:REMOTE_USER} -
this variable is set by the authorization phases, which come *after* the
URL translation phase (during which mod_rewrite operates).
</snip>
So would say you can use this in a rewrite rule to pass on the REMOTE_USER
in the query string for example by using the QSA flag and proxying to the
backend in the same time:
RewriteCond %{LA-U:REMOTE_USER} (.*)
RewriteRule ^/something.html something.jsp?userid=%{LA-U:REMOTE_USER}
[QSA,P,L]
Just an idea and completely untested. Hope someone will correct me in case
I'm talking gibberish here ....
RE: [users@httpd] Passing proxy authentication user name
Posted by te...@sympatico.ca.
That's the option.
I don't have the user's name, that's what I need from the proxy-authorization header which is coming from the proxy server.
> Date: Mon, 14 Jan 2013 18:16:12 +0000
> From: nick@webthing.com
> To: users@httpd.apache.org
> Subject: Re: [users@httpd] Passing proxy authentication user name
>
> On Mon, 14 Jan 2013 16:08:42 +0000
> <te...@sympatico.ca> wrote:
>
> >
> > I have dumped the env and it doesn't include the auth info. I have confirmed that the proxy-authorization header is being sent by the proxy server.
> > I found somewhere, that I can't find again, something that implied that apache had to be compiled with a specific option to allow it to transmit this header to the pages or scripts. I really hope that this isn't the case as I really don't have the weeks required to get a server to build a compile environment and gather all the bits and pieces that I'd need to do that.
>
> Could that be the BIG_SECURITY_HOLE compile option?
> Not sure if that still exists (I don't use it)!
>
> If you have your users' usernames and passwords, you could
> also set the Authorization header from the Proxy-Authorization.
> Then configure the server for authentication and your
> scripts will get REMOTE_USER.
>
> --
> Nick Kew
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
Re: [users@httpd] Passing proxy authentication user name
Posted by Nick Kew <ni...@webthing.com>.
On Mon, 14 Jan 2013 16:08:42 +0000
<te...@sympatico.ca> wrote:
>
> I have dumped the env and it doesn't include the auth info. I have confirmed that the proxy-authorization header is being sent by the proxy server.
> I found somewhere, that I can't find again, something that implied that apache had to be compiled with a specific option to allow it to transmit this header to the pages or scripts. I really hope that this isn't the case as I really don't have the weeks required to get a server to build a compile environment and gather all the bits and pieces that I'd need to do that.
Could that be the BIG_SECURITY_HOLE compile option?
Not sure if that still exists (I don't use it)!
If you have your users' usernames and passwords, you could
also set the Authorization header from the Proxy-Authorization.
Then configure the server for authentication and your
scripts will get REMOTE_USER.
--
Nick Kew
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] Passing proxy authentication user name
Posted by te...@sympatico.ca.
I have dumped the env and it doesn't include the auth info. I have confirmed that the proxy-authorization header is being sent by the proxy server.
I found somewhere, that I can't find again, something that implied that apache had to be compiled with a specific option to allow it to transmit this header to the pages or scripts. I really hope that this isn't the case as I really don't have the weeks required to get a server to build a compile environment and gather all the bits and pieces that I'd need to do that.
> Date: Mon, 14 Jan 2013 15:23:57 +0000
> From: nick@webthing.com
> To: users@httpd.apache.org
> Subject: Re: [users@httpd] Passing proxy authentication user name
>
> On Mon, 14 Jan 2013 14:55:38 +0000
> <te...@sympatico.ca> wrote:
>
>
> > There was a mention of REMOTE-USER, however as I understand that, it's only there if authentication is set up on the http server. There is no authentication on the web server, only on the proxy.
>
> It's too long since I looked at the CGI spec. Have you tried
> a simple CGI script that just dumps its env to see what's
> available?
>
> Otherwise proxy-chain-auth on the proxy will give you REMOTE_USER.
>
> --
> Nick Kew
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
Re: [users@httpd] Passing proxy authentication user name
Posted by Nick Kew <ni...@webthing.com>.
On Mon, 14 Jan 2013 14:55:38 +0000
<te...@sympatico.ca> wrote:
> There was a mention of REMOTE-USER, however as I understand that, it's only there if authentication is set up on the http server. There is no authentication on the web server, only on the proxy.
It's too long since I looked at the CGI spec. Have you tried
a simple CGI script that just dumps its env to see what's
available?
Otherwise proxy-chain-auth on the proxy will give you REMOTE_USER.
--
Nick Kew
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] Passing proxy authentication user name
Posted by te...@sympatico.ca.
The Proxy-Authorization header is being sent from the proxy server so I don't need to recreate it. The problem is that apache is dumping this header and not letting me see it.
This is apache 2.2 on RH 6.3.
There was a mention of REMOTE-USER, however as I understand that, it's only there if authentication is set up on the http server. There is no authentication on the web server, only on the proxy.
Date: Mon, 14 Jan 2013 09:47:12 +1100
From: icicimov@gmail.com
To: users@httpd.apache.org
Subject: Re: [users@httpd] Passing proxy authentication user name
On Mon, Jan 14, 2013 at 8:10 AM, Igor Cicimov <ic...@gmail.com> wrote:
On 14/01/2013 1:48 AM, "Terry Cooper" <te...@sympatico.ca> wrote:
>
> I am currently attempting to migrate an existing system which is built on the Sun web proxy server and the Sun web server to the Apache web server. The proxy portion will remain on Sun until proxy appliances are obtained and installed, so all I’m dealing with now is the move to Apache HTTPD.
>
>
>
> The current system has user access control that is completely based on the proxy server and acls therein. This means that users log into the proxy, but there is no login requirement on the web servers. There are a number of cgi scripts which need to get the user name to operate correctly. Currently the environment variable HTTP_PROXY_AUTHORIZATION is used to obtain this information, however from what I can find this is not passed by Apache to the scripts. I understand the security issue with this as it contains the password as well, which I don’t need. Is there a way to get at least the user name that is passed by the proxy server.
>
>
>
> I’m sure I’m missing something simple here, but I just can’t seem to find it.
>
>
>
> Thanks,
>
>
>
> Terry
Set a header maybe?
RequestHeader append Proxy-Authorization
I mean there is already Authorization request header set why not using it?
Re: [users@httpd] Passing proxy authentication user name
Posted by Igor Cicimov <ic...@gmail.com>.
On Mon, Jan 14, 2013 at 8:10 AM, Igor Cicimov <ic...@gmail.com> wrote:
>
> On 14/01/2013 1:48 AM, "Terry Cooper" <te...@sympatico.ca> wrote:
> >
> > I am currently attempting to migrate an existing system which is built
> on the Sun web proxy server and the Sun web server to the Apache web
> server. The proxy portion will remain on Sun until proxy appliances are
> obtained and installed, so all I’m dealing with now is the move to Apache
> HTTPD.
> >
> >
> >
> > The current system has user access control that is completely based on
> the proxy server and acls therein. This means that users log into the
> proxy, but there is no login requirement on the web servers. There are a
> number of cgi scripts which need to get the user name to operate correctly.
> Currently the environment variable HTTP_PROXY_AUTHORIZATION is used to
> obtain this information, however from what I can find this is not passed by
> Apache to the scripts. I understand the security issue with this as it
> contains the password as well, which I don’t need. Is there a way to get at
> least the user name that is passed by the proxy server.
> >
> >
> >
> > I’m sure I’m missing something simple here, but I just can’t seem to
> find it.
> >
> >
> >
> > Thanks,
> >
> >
> >
> > Terry
>
> Set a header maybe?
>
> RequestHeader append Proxy-Authorization
>
I mean there is already Authorization request header set why not using it?
Re: [users@httpd] Passing proxy authentication user name
Posted by Igor Cicimov <ic...@gmail.com>.
On 14/01/2013 1:48 AM, "Terry Cooper" <te...@sympatico.ca> wrote:
>
> I am currently attempting to migrate an existing system which is built on
the Sun web proxy server and the Sun web server to the Apache web server.
The proxy portion will remain on Sun until proxy appliances are obtained
and installed, so all I’m dealing with now is the move to Apache HTTPD.
>
>
>
> The current system has user access control that is completely based on
the proxy server and acls therein. This means that users log into the
proxy, but there is no login requirement on the web servers. There are a
number of cgi scripts which need to get the user name to operate correctly.
Currently the environment variable HTTP_PROXY_AUTHORIZATION is used to
obtain this information, however from what I can find this is not passed by
Apache to the scripts. I understand the security issue with this as it
contains the password as well, which I don’t need. Is there a way to get at
least the user name that is passed by the proxy server.
>
>
>
> I’m sure I’m missing something simple here, but I just can’t seem to find
it.
>
>
>
> Thanks,
>
>
>
> Terry
Set a header maybe?
RequestHeader append Proxy-Authorization