OIDC configuration Apache and uwsgi

[MalfuncEddie]

Hi,

I ran into https://docs.netbox.dev/en/stable/configuration/remote-authentication/#remote_auth_header

Some WSGI servers may drop headers which contain unsupported characters. 
For instance, gunicorn v22.0 and later silently drops HTTP headers containing underscores. 
This behavior can be disabled by changing gunicorn's [header_map](https://docs.gunicorn.org/en/stable/settings.html#header-map) setting to dangerous.

This workaround works.

I would like to get this same behavior working on uwsgi. The documentation shows an example for nginx but I would like this to be expanded for apache2. (https://docs.netbox.dev/en/stable/installation/4b-uwsgi/)

Currently just changing

#ProxyPass / http://127.0.0.1:8001/
    #ProxyPassReverse / http://127.0.0.1:8001/

    ProxyPass / uwsgi://127.0.0.1:8001/
    ProxyPassReverse / uwsgi://127.0.0.1:8001/

Does not log me in via SSO.

Is there another option that needs to be set just like gunicorn?

[candlerb]

Rather than tweaking gunicorn to accept underscores in headers, my solution was to stop sending underscores in headers in the first place.

With mod_auth_openidc, this did the trick:

    OIDCRemoteUserClaim preferred_username
    OIDCPassUserInfoAs claims
    OIDCPassClaimsAs headers

    OIDCClaimPrefix OIDC-Claim-
    RequestHeader unset Remote-User
    RequestHeader set Remote-User expr=%{REMOTE_USER}

This works for everything except for OIDC-Claim-XXX when the claim name itself contains an underscore. In the standard claims these include preferred_username, given_name, family_name, middle_name.

However it's not a problem for me, as Netbox is looking at the Remote-User header rather than OIDC-Claim-preferred_username. The only other one that Netbox is interested in is OIDC-Claim-groups.

Related info: https://github.com/OpenIDC/mod_auth_openidc/issues/707