Reverse proxy/ADFS/REMOTE_USER

[Cantor, Scott]

On 12/16/13, 12:49 PM, "Jason Gauthier" <jgauthier at lastar.com> wrote:

>I decided to pull apache+shib to a reverse proxy frontend. Authentication
>works, but REMOTE_USER never gets sent to the application now (which is
>still behind apache).

And it never will, you can't do that. You can send a header, provided you
prevent all access to the back-end by anything but the proxy. That's it.
REMOTE_USER is not a header.

> 
>I fought with this for a while thinking it was apache, and finally broke
>down and tested this with Apache¹s basic authentication.  REMOTE_USER was
>sent to the backend.

No, it wasn't. That isn't physically possible in HTTP. REMOTE_USER is
something established locally on a web server, it never crosses a proxy
boundary.

>I can tweak about 3 lines in Apache to back and forth between basic and
>shib.
> 
>I am using ADFS as my IDP, and Shib is acting as an SDP in this case.
>I¹m not sure where the issues is, and this setup is not a strength, so I
>am not sure where to even begin.

I would start by figuring out what it's actually doing that mistakenly
looks like forwarding REMOTE_USER. Once you establish what it's doing, it
can be determined whether there is something to emulate.

-- Scott