Ori.livneh has submitted this change and it was merged.
Change subject: grafana2: rewrite REMOTE_USER envvar into X-WEBAUTH-USER header
......................................................................
grafana2: rewrite REMOTE_USER envvar into X-WEBAUTH-USER header
Apache can't pass the REMOTE_USER environment variable to the backend when it
talks to the backend via HTTP. But we can take the environment variable and
rewrite it into an HTTP header. Which, it turns out, is what Grafana is
expecting anyhow.
Change-Id: Ic47d69ca9f81c0d80d00846ccc415f410c20cddf
---
M manifests/role/grafana2.pp
M modules/wmflib/lib/puppet/parser/functions/ini.rb
M templates/apache/sites/grafana-test.wikimedia.org.erb
3 files changed, 9 insertions(+), 3 deletions(-)
Approvals:
Ori.livneh: Verified; Looks good to me, approved
diff --git a/manifests/role/grafana2.pp b/manifests/role/grafana2.pp
index d548bf7..0da0cd1 100644
--- a/manifests/role/grafana2.pp
+++ b/manifests/role/grafana2.pp
@@ -45,10 +45,12 @@
},
# Automatically create an account for users and authenticate
- # them based on the REMOTE_USER env var set by mod_authnz_ldap.
+ # them based on the X-WEBAUTH-USER. We use mod_rewrite to
+ # rewrite the REMOTE_USER env var set by mod_authnz_ldap into
+ # X-WEBAUTH-USER.
'auth.proxy' => {
enabled => true,
- header_name => 'REMOTE_USER',
+ header_name => 'X-WEBAUTH-USER',
auto_sign_up => true,
},
diff --git a/modules/wmflib/lib/puppet/parser/functions/ini.rb
b/modules/wmflib/lib/puppet/parser/functions/ini.rb
index 9821f6d..19a0d28 100644
--- a/modules/wmflib/lib/puppet/parser/functions/ini.rb
+++ b/modules/wmflib/lib/puppet/parser/functions/ini.rb
@@ -37,6 +37,6 @@
else "#{k} = #{ini_cast(vs)}"
end
end.flatten.sort.push('').unshift("[#{section}]").join("\n")
- end.flatten.push('').join("\n")
+ end.flatten.sort.push('').join("\n")
end
end
diff --git a/templates/apache/sites/grafana-test.wikimedia.org.erb
b/templates/apache/sites/grafana-test.wikimedia.org.erb
index 9c0e58e..64e410c 100644
--- a/templates/apache/sites/grafana-test.wikimedia.org.erb
+++ b/templates/apache/sites/grafana-test.wikimedia.org.erb
@@ -14,6 +14,10 @@
Header always merge Vary X-Forwarded-Proto env=ProtoRedirect
Header always set Strict-Transport-Security "max-age=31536000"
+ # Rewrite REMOTE_USER envvar into X-WEBAUTH-USER header.
+ RewriteRule .* - [E=WEBAUTH_USER:%{LA-U:REMOTE_USER}]
+ RequestHeader set X-WEBAUTH-USER %{WEBAUTH_USER}e
+
<Proxy *>
AuthName "<%= @auth_ldap['name'] %>"
AuthType Basic
--
To view, visit https://gerrit.wikimedia.org/r/245892
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: Ic47d69ca9f81c0d80d00846ccc415f410c20cddf
Gerrit-PatchSet: 3
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Ori.livneh <[email protected]>
Gerrit-Reviewer: Ori.livneh <[email protected]>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
