Different behavior in X-FORWARED-USER after updating to 2.4.15.4

[HolgerHees]

In version 2.4.15.3 I had the following apache configuration.

RewriteMap lookupUser "txt:/etc/apache2/_.ansible.auth/auth_openidc_users.txt"
RewriteMap lookupGroup "txt:/etc/apache2/_.ansible.auth/auth_openidc_user_groups.txt"
RewriteMap lookupFullname "txt:/etc/apache2/_.ansible.auth/auth_openidc_user_fullnames.txt"

<Location />
    AuthType openid-connect
    ErrorDocument 401 /_auth/unauthorized.html

    RewriteRule ^ - [E=REMOTE_USERNAME:${lookupUser:%{ENV:OIDC_CLAIM_email}},E=REMOTE_USERGROUP:${lookupGroup:%{ENV:OIDC_CLAIM_email}},E=REMOTE_USERFULLNAME:${lookupFullname:%{ENV:OIDC_CLAIM_email}}]
</Location>

the result was that I had the following ENV variables

HTTP_X_FORWARDED_USERFULLNAME => value of mapped userfullname
HTTP_X_FORWARDED_USERGROUP => value of mapped usergroups
HTTP_X_FORWARDED_USER => value of mapped username
REMOTE_USERFULLNAME => value of mapped userfullname
REMOTE_USERGROUP => value of mapped usergroups
REMOTE_USERNAME => value of mapped username

after upgrading from version 2.4.15.3 to 2.4.15.4 (same apache container, just compiled the new openidc version inside)

HTTP_X_FORWARDED_USERFULLNAME => value of mapped userfullname
HTTP_X_FORWARDED_USERGROUP => value of mapped usergroups
HTTP_X_FORWARDED_USER => value of OIDC_CLAIM_email
REMOTE_USERFULLNAME => value of mapped userfullname
REMOTE_USERGROUP => value of mapped usergroups
REMOTE_USERNAME => value of OIDC_CLAIM_email

this time, I have no idea which commit could be related to it.

I just reverted back to version 2.4.15.3 and everything works like before again.

[zandbelt]

I think you've spotted a serious bug... you probably have set OIDCPassClaimsAs environment?

[zandbelt]

please confirm that 595681c fixes things for you, and we'll release 2.4.15.5 right away, sorry for the hassle

[HolgerHees]

2 times, yes. :-)

I use "OIDCPassClaimsAs environment" and it fixed it for me ;-)

[HolgerHees]

thanks for this fast response and fix. Will close this discussion and look forward for 2.4.15.5

[zandbelt]

https://github.com/OpenIDC/mod_auth_openidc/releases/tag/v2.4.15.5