accessing REMOTE_USER through an Apache proxy

--Apple-Mail-3--738963895
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
charset=us-ascii;
format=flowed;
delsp=yes

We proxy connections trough Apache to GlassFish Web Applications, and
would like to give those applications access to the http REMOTE_USER
variable. To make sure this is not related to GlassFish, I have
created a very basic test script. The kerberos authentication and
Apache proxy work properly, and the script is able to see the
REMOTE_USER variable when called directly. However, the script can
not see the REMOTE_USER variable when it's accessed through a proxy.
It seems as though this has been discussed several times, but I have
not been able to make any of the proposed solutions work.

Here is the relevant portion of our configuration file file.

------
######
# GlassFish proxy
ProxyPreserveHost on

RewriteEngine on
RewriteLog /var/log/httpd/rewrite.log
RewriteLogLevel 9

RequestHeader Set Proxy-keysize 512
RequestHeader Set Proxy-ip %{REMOTE_ADDR}e
RequestHeader Set Host ourserver.com:443
RequestHeader set REMOTE_USER %{LA-U:REMOTE_USER}e

RewriteRule ^/test$ /test/ [R,L]
RewriteRule ^/test/(.*) http://localhost/cgi-bin/test/$1
[P,L,E=REMOTE_USER:%{LA-U:REMOTE_USER}]

order deny,allow
deny from all
AuthType KerberosV5
AuthName "kerberos authentication"
Satisfy any
require valid-user

------

And here is what I see in rewrite.log. REMOTE_USER is eventually set
properly, just not soon enough for the script.
------
.... [rid#8aa28f8/initial] (2) init rewrite engine with requested uri /
test/remote.cgi
.... [rid#8aa28f8/initial] (3) applying pattern '^/test$' to uri '/test/
remote.cgi'
.... [rid#8aa28f8/initial] (3) applying pattern '^/test/(.*)' to uri '/
test/remote.cgi'
.... [rid#8aa28f8/initial] (2) rewrite /test/remote.cgi -> http://localhost/cgi-bin/test/remote.cgi
.... [rid#8aa4900/subreq] (2) init rewrite engine with requested uri /
test/remote.cgi
.... [rid#8aa4900/subreq] (1) pass through /test/remote.cgi
.... [rid#8aa28f8/initial] (5) lookahead: path=/test/remote.cgi
var=REMOTE_USER -> val=
.... [rid#8aa28f8/initial] (5) setting env variable 'REMOTE_USER' to ''
.... [rid#8aa28f8/initial] (2) forcing proxy-throughput with http://localhost/cgi-bin/test/remote.cgi
.... [rid#8aa28f8/initial] (1) go-ahead with proxy request proxy:http://
localhost/cgi-bin/test/remote.cgi [OK]
.... [rid#8aa8908/initial] (2) init rewrite engine with requested uri /
test/remote.cgi
.... [rid#8aa8908/initial] (3) applying pattern '^/test$' to uri '/test/
remote.cgi'
.... [rid#8aa8908/initial] (3) applying pattern '^/test/(.*)' to uri '/
test/remote.cgi'
.... [rid#8aa8908/initial] (2) rewrite /test/remote.cgi -> http://localhost/cgi-bin/test/remote.cgi
.... [rid#8abcf90/subreq] (2) init rewrite engine with requested uri /
test/remote.cgi
.... [rid#8abcf90/subreq] (1) pass through /test/remote.cgi
.... [rid#8aa8908/initial] (5) lookahead: path=/test/remote.cgi
var=REMOTE_USER -> val=dab66
.... [rid#8aa8908/initial] (5) setting env variable 'REMOTE_USER' to
'dab66'
.... [rid#8aa8908/initial] (2) forcing proxy-throughput with http://localhost/cgi-bin/test/remote.cgi
.... [rid#8aa8908/initial] (1) go-ahead with proxy request proxy:http://
localhost/cgi-bin/test/remote.cgi [OK]
------

Any suggestions would be greatly appreciated. Please let me know if
there is any more information I can provide.

Many thanks,
Devin
--Apple-Mail-3--738963895
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
charset=us-ascii

-webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">We =
proxy connections trough Apache to GlassFish Web Applications, and would =
like to give those applications access to the http REMOTE_USER variable. =
 To make sure this is not related to GlassFish, I have created a =
very basic test script.  The kerberos authentication and Apache =
proxy work properly, and the script is able to see the REMOTE_USER =
variable when called directly.  However, the script can not see the =
 REMOTE_USER variable when it's accessed through a proxy.  It =
seems as though this has been discussed several times, but I have not =
been able to make any of the proposed solutions =
work.

Re: accessing REMOTE_USER through an Apache proxy

Devin Bougie wrote:
....

Hi.

I'll give you my interpretation, after looking at the log, not really at
the configuration.

I think the confusion may be about when and where, things happen
exactly. And it is not really helped by your choice to proxy from your
server to itself..

If you examine the log below, you will see different/distinct requests,
identified by their respective "rid" number.

The first is the request rid#8aa28f8 that comes in originally, on your
"first" server (before the proxying occurs).
That one does the proxying before your is even invoked
(in my opinion). So at that point, the authentication has not even
happened, and REMOTE_USER is undefined or empty.
That request, you then proxy to your "second" server.

Now the proxied request comes in to your "second" server. That is
request rid#8aa8908. That one starts without a REMOTE_USER (see above),
but then goes through the section, where it acquires an id.
But by then it is too late for proxying..

It would all probably be clearer if you set this up in two distinct
VirtualHosts, and proxied from the first to the second.

Another thing, is that Apache "environment variables", are kind of
"virtual", in the sense that they exist inside of Apache, for the
duration of one request.
When you proxy something to another server, this is a new request, and
this other server does not magically inherit the environment of your
first request in the first server.
To pass it on, you would have to set it in a header which you pass to
the second server. But then, you must have a value to pass, by the time
you create the header.
Which does not seem to be the case here.

Hope that is clear.
As for me, I think I need a cup of coffee now.


>
> ------
> ######
> # GlassFish proxy
> ProxyPreserveHost on
>
> RewriteEngine on
> RewriteLog /var/log/httpd/rewrite.log
> RewriteLogLevel 9
>
> RequestHeader Set Proxy-keysize 512
> RequestHeader Set Proxy-ip %{REMOTE_ADDR}e
> RequestHeader Set Host ourserver.com:443
> RequestHeader set REMOTE_USER %{LA-U:REMOTE_USER}e
>
> RewriteRule ^/test$ /test/ [R,L]
> RewriteRule ^/test/(.*) http://localhost/cgi-bin/test/$1
> [P,L,E=REMOTE_USER:%{LA-U:REMOTE_USER}]
>
> order deny,allow
> deny from all
> AuthType KerberosV5
> AuthName "kerberos authentication"
> Satisfy any
> require valid-user
>
> ------
>
> And here is what I see in rewrite.log. REMOTE_USER is eventually set
> properly, just not soon enough for the script.
> ------
> ... [rid#8aa28f8/initial] (2) init rewrite engine with requested uri
> /test/remote.cgi
> ... [rid#8aa28f8/initial] (3) applying pattern '^/test$' to uri
> '/test/remote.cgi'
> ... [rid#8aa28f8/initial] (3) applying pattern '^/test/(.*)' to uri
> '/test/remote.cgi'
> ... [rid#8aa28f8/initial] (2) rewrite /test/remote.cgi ->
> http://localhost/cgi-bin/test/remote.cgi
> ... [rid#8aa4900/subreq] (2) init rewrite engine with requested uri
> /test/remote.cgi
> ... [rid#8aa4900/subreq] (1) pass through /test/remote.cgi
> ... [rid#8aa28f8/initial] (5) lookahead: path=/test/remote.cgi
> var=REMOTE_USER -> val=
> ... [rid#8aa28f8/initial] (5) setting env variable 'REMOTE_USER' to ''
> ... [rid#8aa28f8/initial] (2) forcing proxy-throughput with
> http://localhost/cgi-bin/test/remote.cgi
> ... [rid#8aa28f8/initial] (1) go-ahead with proxy request
> proxy:http://localhost/cgi-bin/test/remote.cgi [OK]
> ... [rid#8aa8908/initial] (2) init rewrite engine with requested uri
> /test/remote.cgi
> ... [rid#8aa8908/initial] (3) applying pattern '^/test$' to uri
> '/test/remote.cgi'
> ... [rid#8aa8908/initial] (3) applying pattern '^/test/(.*)' to uri
> '/test/remote.cgi'
> ... [rid#8aa8908/initial] (2) rewrite /test/remote.cgi ->
> http://localhost/cgi-bin/test/remote.cgi
> ... [rid#8abcf90/subreq] (2) init rewrite engine with requested uri
> /test/remote.cgi
> ... [rid#8abcf90/subreq] (1) pass through /test/remote.cgi
> ... [rid#8aa8908/initial] (5) lookahead: path=/test/remote.cgi
> var=REMOTE_USER -> val=dab66
> ... [rid#8aa8908/initial] (5) setting env variable 'REMOTE_USER' to 'dab66'
> ... [rid#8aa8908/initial] (2) forcing proxy-throughput with
> http://localhost/cgi-bin/test/remote.cgi
> ... [rid#8aa8908/initial] (1) go-ahead with proxy request
> proxy:http://localhost/cgi-bin/test/remote.cgi [OK]
> ------
>
> Any suggestions would be greatly appreciated. Please let me know if
> there is any more information I can provide.
>
> Many thanks,
> Devin


------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: accessing REMOTE_USER through an Apache proxy

--Apple-Mail-5--719847092
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=iso-8859-1;
format=flowed;
delsp=yes

Hi Andr=E9,

Thank you very much for your time and explanation. For what it's =20
worth, I have tried inserting a RewriteCond to make sure the proxy =20
only occurs when REMOTE_USER is set. This cleaned up the rewrite.log =20=

file a bit, but the script is still not able to see REMOTE_USER. Here =20=

is our updated configuration and rewrite.log.

------
######
# GlassFish proxy
ProxyPreserveHost on

RewriteEngine on
RewriteCond %{LA-U:REMOTE_USER} (.+)
RewriteLog /var/log/httpd/rewrite.log
RewriteLogLevel 9

RequestHeader Set Proxy-keysize 512
RequestHeader Set Proxy-ip %{REMOTE_ADDR}e
RequestHeader Set Host ourserver.com:443
RequestHeader set REMOTE_USER %{LA-U:REMOTE_USER}e

RewriteRule ^/test$ /test/ [R,L]
RewriteRule ^/test/(.*) http://localhost/cgi-bin/test/$1 =20
[P,L,E=3DREMOTE_USER:%{LA-U:REMOTE_USER}]

order deny,allow
deny from all
AuthType KerberosV5
AuthName "kerberos authentication"
Satisfy any
require valid-user

------
.... [rid#8e23fc0/initial] (2) init rewrite engine with requested uri /=20=

test/remote.cgi
.... [rid#8e23fc0/initial] (3) applying pattern '^/test$' to uri '/test/=20=

remote.cgi'
.... [rid#8e23fc0/initial] (3) applying pattern '^/test/(.*)' to uri '/=20=

test/remote.cgi'
.... [rid#8e23fc0/initial] (2) rewrite /test/remote.cgi -> =
http://localhost/cgi-bin/test/remote.cgi
.... [rid#8e38648/subreq] (2) init rewrite engine with requested uri /=20
test/remote.cgi
.... [rid#8e38648/subreq] (1) pass through /test/remote.cgi
.... [rid#8e23fc0/initial] (5) lookahead: path=3D/test/remote.cgi =20
var=3DREMOTE_USER -> val=3Ddab66
.... [rid#8e23fc0/initial] (5) setting env variable 'REMOTE_USER' to =20
'dab66'
.... [rid#8e23fc0/initial] (2) forcing proxy-throughput with =
http://localhost/cgi-bin/test/remote.cgi
.... [rid#8e23fc0/initial] (1) go-ahead with proxy request proxy:http://=20=

localhost/cgi-bin/test/remote.cgi [OK]
------

Our end goal is to proxy from the Apache server to a GlassFish =20
Enterprise Server. Just for reference, here is the rewrite.log for a =20=

request that's proxied to a GlassFish Web Application.
------
.... [rid#8e23fc8/initial] (2) init rewrite engine with requested uri /=20=

HelloWeb/UserServlet
.... [rid#8e23fc8/initial] (3) applying pattern '^/HelloWeb$' to uri '/=20=

HelloWeb/UserServlet'
.... [rid#8e23fc8/initial] (3) applying pattern '^/HelloWeb/(.*)' to =20
uri '/HelloWeb/UserServlet'
.... [rid#8e23fc8/initial] (2) rewrite /HelloWeb/UserServlet -> =
http://localhost:38080/HelloWeb/UserServlet
.... [rid#8e1ffb8/subreq] (2) init rewrite engine with requested uri /=20
HelloWeb/UserServlet
.... [rid#8e1ffb8/subreq] (1) pass through /HelloWeb/UserServlet
.... [rid#8e23fc8/initial] (5) lookahead: path=3D/HelloWeb/UserServlet =20=

var=3DREMOTE_USER -> val=3Ddab66
.... [rid#8e23fc8/initial] (5) setting env variable 'REMOTE_USER' to =20
'dab66'
.... [rid#8e23fc8/initial] (2) forcing proxy-throughput with =
http://localhost:38080/HelloWeb/UserServlet
.... [rid#8e23fc8/initial] (1) go-ahead with proxy request proxy:http://=20=

localhost:38080/HelloWeb/UserServlet [OK]
------

Any suggestions would be greatly appreciated.

Thank you again,
Devin

On Oct 28, 2009, at 11:15 AM, Andr=E9 Warnier wrote:

> Devin Bougie wrote:
> ...
>
> Hi.
>
> I'll give you my interpretation, after looking at the log, not =20
> really at the configuration.
>
> I think the confusion may be about when and where, things happen =20
> exactly. And it is not really helped by your choice to proxy from =20
> your server to itself..
>
> If you examine the log below, you will see different/distinct =20
> requests, identified by their respective "rid" number.
>
> The first is the request rid#8aa28f8 that comes in originally, on =20
> your "first" server (before the proxying occurs).
> That one does the proxying before your is even =20
> invoked (in my opinion). So at that point, the authentication has =20
> not even happened, and REMOTE_USER is undefined or empty.
> That request, you then proxy to your "second" server.
>
> Now the proxied request comes in to your "second" server. That is =20
> request rid#8aa8908. That one starts without a REMOTE_USER (see =20
> above), but then goes through the section, where it =20
> acquires an id.
> But by then it is too late for proxying..
>
> It would all probably be clearer if you set this up in two distinct =20=

> VirtualHosts, and proxied from the first to the second.
>
> Another thing, is that Apache "environment variables", are kind of =20
> "virtual", in the sense that they exist inside of Apache, for the =20
> duration of one request.
> When you proxy something to another server, this is a new request, =20
> and this other server does not magically inherit the environment of =20=

> your first request in the first server.
> To pass it on, you would have to set it in a header which you pass =20
> to the second server. But then, you must have a value to pass, by =20
> the time you create the header.
> Which does not seem to be the case here.
>
> Hope that is clear.
> As for me, I think I need a cup of coffee now.
>
>
>> ------
>> ######
>> # GlassFish proxy
>> ProxyPreserveHost on
>> RewriteEngine on
>> RewriteLog /var/log/httpd/rewrite.log
>> RewriteLogLevel 9
>> RequestHeader Set Proxy-keysize 512
>> RequestHeader Set Proxy-ip %{REMOTE_ADDR}e
>> RequestHeader Set Host ourserver.com:443
>> RequestHeader set REMOTE_USER %{LA-U:REMOTE_USER}e
>> RewriteRule ^/test$ /test/ [R,L]
>> RewriteRule ^/test/(.*) http://localhost/cgi-bin/test/$1 =20
>> [P,L,E=3DREMOTE_USER:%{LA-U:REMOTE_USER}]
>>
>> order deny,allow
>> deny from all
>> AuthType KerberosV5
>> AuthName "kerberos authentication"
>> Satisfy any
>> require valid-user
>>
>> ------
>> And here is what I see in rewrite.log. REMOTE_USER is eventually =20
>> set properly, just not soon enough for the script.
>> ------
>> ... [rid#8aa28f8/initial] (2) init rewrite engine with requested =20
>> uri /test/remote.cgi
>> ... [rid#8aa28f8/initial] (3) applying pattern '^/test$' to uri '/=20
>> test/remote.cgi'
>> ... [rid#8aa28f8/initial] (3) applying pattern '^/test/(.*)' to uri =20=

>> '/test/remote.cgi'
>> ... [rid#8aa28f8/initial] (2) rewrite /test/remote.cgi -> =
http://localhost/cgi-bin/test/remote.cgi
>> ... [rid#8aa4900/subreq] (2) init rewrite engine with requested =20
>> uri /test/remote.cgi
>> ... [rid#8aa4900/subreq] (1) pass through /test/remote.cgi
>> ... [rid#8aa28f8/initial] (5) lookahead: path=3D/test/remote.cgi =20
>> var=3DREMOTE_USER -> val=3D
>> ... [rid#8aa28f8/initial] (5) setting env variable 'REMOTE_USER' to =20=

>> ''
>> ... [rid#8aa28f8/initial] (2) forcing proxy-throughput with =
http://localhost/cgi-bin/test/remote.cgi
>> ... [rid#8aa28f8/initial] (1) go-ahead with proxy request =20
>> proxy:http://localhost/cgi-bin/test/remote.cgi [OK]
>> ... [rid#8aa8908/initial] (2) init rewrite engine with requested =20
>> uri /test/remote.cgi
>> ... [rid#8aa8908/initial] (3) applying pattern '^/test$' to uri '/=20
>> test/remote.cgi'
>> ... [rid#8aa8908/initial] (3) applying pattern '^/test/(.*)' to uri =20=

>> '/test/remote.cgi'
>> ... [rid#8aa8908/initial] (2) rewrite /test/remote.cgi -> =
http://localhost/cgi-bin/test/remote.cgi
>> ... [rid#8abcf90/subreq] (2) init rewrite engine with requested =20
>> uri /test/remote.cgi
>> ... [rid#8abcf90/subreq] (1) pass through /test/remote.cgi
>> ... [rid#8aa8908/initial] (5) lookahead: path=3D/test/remote.cgi =20
>> var=3DREMOTE_USER -> val=3Ddab66
>> ... [rid#8aa8908/initial] (5) setting env variable 'REMOTE_USER' to =20=

>> 'dab66'
>> ... [rid#8aa8908/initial] (2) forcing proxy-throughput with =
http://localhost/cgi-bin/test/remote.cgi
>> ... [rid#8aa8908/initial] (1) go-ahead with proxy request =20
>> proxy:http://localhost/cgi-bin/test/remote.cgi [OK]
>> ------
>> Any suggestions would be greatly appreciated. Please let me know =20
>> if there is any more information I can provide.
>> Many thanks,
>> Devin
>
>
> ------------------------------------------------------------ ---------
> The official User-To-User support forum of the Apache HTTP Server =20
> Project.
> See for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>


--Apple-Mail-5--719847092
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
charset=iso-8859-1

-webkit-nbsp-mode: space; -webkit-line-break: after-white-space; =
">Hi Andr=E9,