Conditionally setting a header based on Roles

[c1rdan]

I have an apache 2.4 acting as reverse proxy for an application. I need to conditionally setup a header for the proxy based on the user roles, but I don't know how to use this inside an If statement.

As an example, this works appropriately:

<Location "/app">
    Require claim roles:app_reader
    RequestHeader set Authorization "Basic ${READER_TOKEN}"
</Location>

However, I need to do something like this:

<Location "/app">
    AuthType openid-connect
    Require valid-user
    <If "%{ENV:OIDC_CLAIM_roles} =~ /.*app_admin.*/">
        RequestHeader set Authorization "Basic ${ADMIN_TOKEN}"
    </If>
    <ElseIf "%{ENV:OIDC_CLAIM_roles} =~ /.*app_reader.*/">
        RequestHeader set Authorization "Basic ${READER_TOKEN}"
    </ElseIf>
</Location>

The latest doesn't work, as I'm not sure how to actually refer to the mod_auth_openidc expression. As reference I have OIDCPassClaimsAs both on the configuration.

I have confirmed with a toy phpinfo() that OIDC_CLAIM_roles is being passed as both header and env. I also tried to use an -n instead of the regex to confirm that's not the problem. The env/regex doesn't appear to be defined on the section.

Any suggestions on which is the proper way of doing this?

[zandbelt]

I don't think that is possible since it appears that <If> statements are processed before authentication happens, see https://httpd.apache.org/docs/current/expr.html#vars
I'd suggest to change the app to read the OIDC roles header rather than the Authorization header.

[c1rdan]

Sadly I cannot control the application. I could put another proxy in the middle just to handle this, but feels inadequate.

Can you imagine another way of achieving the same thing? I know it's not fully related to mod_auth_openidc by now, but I'm out of ideas.

[zandbelt]

cook up an apache expression within the RequestHeader primitive like this one:

    RequestHeader set Authorization "Basic admintoken" "expr=reqenv('OIDC_CLAIM_email')=='[email protected]'"

that evaluates roles and sets the header based on that; this way you'd avoid using <If> since that expression is evaluated late/realtime

you can have 2 of those, slightlly more complex because you're doing a "flattened array" comparison

[c1rdan]

That's a brilliant idea!! Thank you very much ❤️. I have just tested it and appears to do exactly what I need.