Apache mod_proxy, Jetty, and IDP endopint problem

[John Dennis]

On 06/10/2015 06:14 PM, Jim Fox wrote:
>
> To get a REMOTE_USER to the Idp:
>
>   RewriteEngine On
>   RewriteCond %{LA-U:REMOTE_USER} (.+)
>   RewriteRule . - [E=RU:%1]
>   RequestHeader set REMOTE-USER %{REMOTE_USER}s
>
> and then configure the idp to get remoteuser from the header.

Just a heads up, having dealt extensively with proxying from Apache to a 
J2EE servlet I can tell you the above only works with 1 environment 
variable. If you google the above will always turn up as the recommended 
solution. If you try to send more than one environment variable the LA-U 
RewriteCond logic seems to get into an infinite loop (or infinite 
recursion).  I never was able to figure out how to send more than one 
environment variable despite pouring over the Apache source code and 
many hours spent in the debugger tracing things. It was pretty opaque.

I authored the following document for another project, it has nothing to 
do with SAML, but nonetheless it describes a configuration where Apache 
is used as a front end performing authentication and identity lookup's 
and then passing (e.g. proxying) to a J2EE servlet running in either 
Jetty or Tomcat. Although a large part of the document discusses issue 
specific to the project there are a number of sections dealing with the 
proxy problem and it's security, those you may find interesting.

https://jdennis.fedorapeople.org/doc/sssd_configuration.pdf

Ultimately what we did when we couldn't use AJP was add a servlet filter 
that extends HttpServletRequestWrapper and overrides the methods 
getRemoteUser(), getAuthType(), getAttribute() etc. and pulls the data 
out of the request header if it not already set. The advantage of this 
approach is that existing servlet code does not need to be modified, it 
remains completely ignorant of the underlying transport, in other words 
you get the advantages of AJP without having to use AJP.

I'm happy to share the filter code if there is an interest.

John