mod_auth_openidc with mod_proxy and mod_rewrite

[AkihaTohno]

Hi, all.
I have some questions about mod_auth_openidc.
My application is standard Java application with reverse proxy.
It runs on Tomcat9 via AJP protocol.
Httpd works reverse proxy and authentication proxy through keycloack.
When some users who are already authenticated with keycloack access to JAVA application,
mod_auth_openidc sends first request with no REMOTE USER.
So, Java application said that "Not authorized access".
Is it correct work?

Regards,

[zandbelt]

that seems like an Apache issue to me (the REMOTE_USER is not directly set by the module itself); perhaps you can apply something like: https://renaudmarti.net/posts/make-apache-proxy-remote-user-to-backend/

[AkihaTohno]

Thank you for your messaage.

I confirmed that auth_openidc.conf has already configured same config you taught me.
But the situation doesn't improve.
I researched more informations.
Target browser is IE11 on Windows10.
1st requests for my Java application has no REMOTE_USER entry.
In this case, the user who access to my Java application has already authenticated by keycloack.
Off cause,browser is same session.
But 2nd access of same user,REMOTE_USER has correct value.
How can I configure my configuration ?
Regards,

[AkihaTohno]

From Fiddler debugger,first access to my Java application of IE11 was not send cookie which keycloack added.
Then, Apache(reverse probably) returned "Submitting Authentication Request" page.
It seems that Apache(reverse proxy) send GET request to my Java application.(So, it logged authentication failed message, I think)
Is it correct access?

Regards,