2

I have configured mod_auth_openidc on an apache 2.4 server. Everything is working ok for protected locations. For those resources the backend applications (PHP script or reverse proxied application) receive the claims as HTTP headers OIDC_xxx.

On this web server I also have public locations. Nevertheless if an authenticated user hits ones of those resource, I would also like to receive the OIDC headers.

My httpd config looks like

<Location /private>
   AuthType openid-connect
   <RequireAll>
      Require valid-user
      Require claim groups:B2C
   </RequireAll>
</Location>
<Location /public>
   AuthType openid-connect
   <RequireAny>
      Require valid-user
      Require all granted
   </RequireAny>
</Location>

The private location is well protected by the oidc provider and HTTP headers are pouplated. The public location can be reached by unauthenticated users (require all granted); but nevertheless is there a way to configure httpd and mod_auth_openidc to popûlate the headers for authenticated users hitting the public location. The above configuration does not do it in any case (no OIDC_ headers).

Thanks.

boubou191911
  • 56
  • 5

1 Answers1

1

There's a way to configure this so-called "lazy sessions" by using:

OIDCUnAuthAction pass

in that particular location, see the docs for the OIDCUnAuthAction primitive:

Defines the action to be taken when an unauthenticated request is made.

"auth" means that the user is redirected to the OpenID Connect Provider or Discovery page.
"401" means that HTTP 401 Unauthorized is returned.
"410" means that HTTP 410 Gone is returned.
"pass" means that an unauthenticated request will pass but claims will still be passed when a user happens to be authenticated already.

Useful in Location/Directory/Proxy path contexts that serve AJAX/Javascript calls and for "anonymous access".
When not defined the default "auth" is used.

OIDCUnAuthAction [auth|pass|401|410]

Hans Z.
  • 50,496
  • 12
  • 102
  • 115
  • Thanks Hans to point me out to this directive. In fact this point was also mentioned in the issue https://github.com/zmartzone/mod_auth_openidc/issues/170. In fact I realized this did not work for me because I was using the mod_auth_openidc coming with CentOS7 (ver. 1.8.8); you need at least a version 2.x to have this working properly. It must also be mentioned that the "pass" directive must be in your root folder or default config. – boubou191911 Aug 30 '18 at 06:44
  • The `OIDCUnAuthAction` directive can be in a location/directorty context. – Hans Z. Aug 30 '18 at 09:09