Ori.livneh has uploaded a new change for review.
https://gerrit.wikimedia.org/r/245892
Change subject: grafana2: rewrite REMOTE_USER envvar into X-WEBAUTH-USER header
......................................................................
grafana2: rewrite REMOTE_USER envvar into X-WEBAUTH-USER header
Apache can't pass the REMOTE_USER environment variable to the backend when it
talks to the backend via HTTP. But we can take the environment variable and
rewrite it into an HTTP header. Which, it turns out, is what Grafana is
expecting anyhow.
Change-Id: Ic47d69ca9f81c0d80d00846ccc415f410c20cddf
---
M manifests/role/grafana2.pp
M templates/apache/sites/grafana-test.wikimedia.org.erb
2 files changed, 8 insertions(+), 2 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/operations/puppet
refs/changes/92/245892/1
diff --git a/manifests/role/grafana2.pp b/manifests/role/grafana2.pp
index d548bf7..0da0cd1 100644
--- a/manifests/role/grafana2.pp
+++ b/manifests/role/grafana2.pp
@@ -45,10 +45,12 @@
},
# Automatically create an account for users and authenticate
- # them based on the REMOTE_USER env var set by mod_authnz_ldap.
+ # them based on the X-WEBAUTH-USER. We use mod_rewrite to
+ # rewrite the REMOTE_USER env var set by mod_authnz_ldap into
+ # X-WEBAUTH-USER.
'auth.proxy' => {
enabled => true,
- header_name => 'REMOTE_USER',
+ header_name => 'X-WEBAUTH-USER',
auto_sign_up => true,
},
diff --git a/templates/apache/sites/grafana-test.wikimedia.org.erb
b/templates/apache/sites/grafana-test.wikimedia.org.erb
index 9c0e58e..64e410c 100644
--- a/templates/apache/sites/grafana-test.wikimedia.org.erb
+++ b/templates/apache/sites/grafana-test.wikimedia.org.erb
@@ -14,6 +14,10 @@
Header always merge Vary X-Forwarded-Proto env=ProtoRedirect
Header always set Strict-Transport-Security "max-age=31536000"
+ # Rewrite REMOTE_USER envvar into X-WEBAUTH-USER header.
+ RewriteRule .* - [E=WEBAUTH_USER:%{LA-U:REMOTE_USER}]
+ RequestHeader set X-WEBAUTH-USER %{WEBAUTH_USER}e
+
<Proxy *>
AuthName "<%= @auth_ldap['name'] %>"
AuthType Basic
--
To view, visit https://gerrit.wikimedia.org/r/245892
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: Ic47d69ca9f81c0d80d00846ccc415f410c20cddf
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Ori.livneh <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
