You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Arnaud Lesueur <ar...@gmail.com> on 2008/05/19 16:55:02 UTC
[users@httpd] Apache 2.2.8 + mod_authnz_ldap + mod_header/env variables
Hi folks,
I'm currently using mod_authnz_ldap to process authentication and
authorization on LDAP back-end on Apache 2.2.8. This part is doing
it's work
This authentication is placed in front of a mod_proxy_http in reverse
proxy mode.
I would like to pass user informations to backend applications.
In the documentation :
http://httpd.apache.org/docs/2.2/mod/mod_authnz_ldap.html#exposed
We saw that environment variable AUTHENTICATE_* are populated with
ldap attributes.
I've successfully check this part on a local PHP application. I can
get my variable.
Now, I'd like to push thoses variables in the HTTP header using this
SetEnvIf AUTHENTICATE_MAIL (.*) MAIL=$1
RequestHeader set MAIL "%{MAIL}e
The header stills empty (not null but empty).
I've also tried with REMOTE_USER to do the same thing. This is also
not working while for REMOTE_USER is it working when using
mod_auth_basic or even with REMOTE_ADDR.
My interpretation is that my directives (SetEnvIf and RequestHeader)
are being executed before the authentication/authorization process. Is
it true ? Can we force the order ?
Or is there any other way to push REMOTE_USER / AUTHENTICATE_* in the
HTTP headers for this module ?
Here is my configuration used :
AuthLDAPURL ldap://172.30.29.8/dc=domain,dc=fr?uid,sn,cn,mail?sub?(title=UF)
AuthType Basic
AuthName "secure"
AuthBasicProvider ldap
AuthLDAPBindDN "cn=Directory Manager"
AuthLDAPBindPassword password
AuthLDAPRemoteUserIsDN on
AuthzLDAPAuthoritative on
Require ldap-group cn=mygroup,dc=domain,dc=fr
SetEnvIf REMOTE_USER (.*) USER=$1
RequestHeader set USER "%{USER}e"
SetEnvIf AUTHENTICATE_MAIL (.*) MAIL=$1
RequestHeader set MAIL "%{MAIL}e"
ProxyPass http://localhost:8080/stub/
ProxyPassReverse http://localhost:8080/stub/
Regards,
--
Arnaud Lesueur
LinkedIn: http://www.linkedin.com/in/lesueur
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache 2.2.8 + mod_authnz_ldap + mod_header/env variables
Posted by Arnaud Lesueur <ar...@gmail.com>.
On Mon, May 19, 2008 at 5:13 PM, Eric Covener <co...@gmail.com> wrote:
> On Mon, May 19, 2008 at 10:55 AM, Arnaud Lesueur
> <ar...@gmail.com> wrote:
>
> >
> > My interpretation is that my directives (SetEnvIf and RequestHeader)
> > are being executed before the authentication/authorization process. Is
> > it true ? Can we force the order ?
>
> I think only the SetEnvIf is running too early.
>
> Have you tried using RequestHeader to pull the %{AUTHENTICATE_MAIL}e
> out directly? He seems to be running at the right time (when not in
> early mode)
>
That's true SetEnvIf was running to early. This is now working with a much
cleaner configuration BTW. I've forget to do this test while it wasn't
working with another module.
But is there any way to precise the order of execution ?
Thanks !
--
Arnaud Lesueur
LinkedIn: http://www.linkedin.com/in/lesueur
Re: [users@httpd] Apache 2.2.8 + mod_authnz_ldap + mod_header/env variables
Posted by Eric Covener <co...@gmail.com>.
On Mon, May 19, 2008 at 10:55 AM, Arnaud Lesueur
<ar...@gmail.com> wrote:
>
> My interpretation is that my directives (SetEnvIf and RequestHeader)
> are being executed before the authentication/authorization process. Is
> it true ? Can we force the order ?
I think only the SetEnvIf is running too early.
Have you tried using RequestHeader to pull the %{AUTHENTICATE_MAIL}e
out directly? He seems to be running at the right time (when not in
early mode)
--
Eric Covener
covener@gmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org