Apache mod_proxy, Jetty, and IDP endopint problem

[John Dennis]

On 06/11/2015 04:10 PM, Jim Fox wrote:
>
> Some good points in the article.  You warning about the rewrite 
> condition led me to realize it is not needed.  Since I know by 
> configuration that remote_user is set all I need is
>
>   RequestHeader set REMOTE-USER %{REMOTE_USER}s
>
> My concern was making sure a client-supplied remote-user header 
> wouldn't overrule mine. It seems that as long as all parties treat 
> headers insensitive to case, which mod_headers and j2ee's getHeader 
> both do, my setting will always overwrite anything passed in on the 
> request--regardless of how that one is cased.

Good point about a user supplied REMOTE_USER. The bigger security 
concern is who is allowed to connect and present the REMOTE_USER as 
authoritative, it had better only be the Apache instance you trust 
otherwise spoofing an authenticated user will be ridiculously easy.

John