<div dir="ltr">Hi,<div><br></div><div>Why do you expect remote server where you host RT to respect REMOTE_USER and not to drop it? If a web server would pass remotely provided REMOTE_USER further to an app without additional configuration then we wouldn't use it for authentication.</div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Sep 2, 2013 at 5:14 PM, Oliver Weinmann <span dir="ltr"><<a href="mailto:oliver.weinmann@telespazio-vega.de" target="_blank">oliver.weinmann@telespazio-vega.de</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="DE" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span lang="EN-US">Hi all,<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"><u></u>Â <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">we have successfully setup RT 4.0.4 with ldap_import and mod_auth_kerb. Now we need to get the setup running through our reverse proxy.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"><u></u>Â <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">What we have on our reverse proxy is this:<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"><u></u>Â <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">ProxyPass       /rt/            <a href="http://hostname.local/rt/" target="_blank">
http://hostname.local/rt/</a> max=100<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">ProxyPassReverse /rt/Â Â Â Â Â Â Â Â Â Â Â Â <a href="http://hostname.local/rt/" target="_blank">
http://hostname.local/rt/</a><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"><u></u>Â <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Â Â Â Â Â Â Â RedirectMatch ^/$ /rt/<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"><u></u>Â <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Â Â Â Â Â Â Â # Proxy all locations<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Â Â Â Â Â Â Â <Proxy *><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â AddDefaultCharset off<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Order deny,allow<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Deny from none<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Â Â Â Â Â Â Â </Proxy><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"><u></u>Â <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"><u></u>Â <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Â Â Â Â Â Â Â <Location /rt><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Â Â Â Â Â Â Â AuthType Kerberos<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Â Â Â Â Â Â Â AuthName "Kerberos Login"<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Â Â Â Â Â Â Â KrbAuthRealms KRB5.LOCAL<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Â Â Â Â Â Â Â Krb5KeyTab /etc/apache2/host.keytab<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Â Â Â Â Â Â Â KrbMethodNegotiate on<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Â Â Â Â Â Â Â KrbAuthoritative on<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Â Â Â Â Â Â Â KrbMethodK5Passwd off<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Â Â Â Â Â Â Â KrbSaveCredentials on<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Â Â Â Â Â Â Â require valid-user<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"><u></u>Â <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Â Â Â Â Â Â Â # SSO<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Â Â Â Â Â Â Â RewriteEngine On<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Â Â Â Â Â Â Â RewriteCond %{LA-U:REMOTE_USER} (.+)$<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Â Â Â Â Â Â Â RewriteRule . - [E=RU:%1]<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Â Â Â Â Â Â Â RequestHeader set REMOTE_USER %{RU}e<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"><u></u>Â <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Â Â Â Â Â Â Â </Location><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"><u></u>Â <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Running tcpdump we can see that REMOTE_USER is set and send to the host hosting RT. It looks like RT is not picking it up. As far as I understood is that my user gets authenticated at the proxy and RT should trust these
credentials and log in the user.<u></u><u></u></span></p>
</div>
</div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>Best regards, Ruslan.
</div>