Apache OAuth SSO

Apache can handle OAuth using the mod_auth_openidc module. This helps legacy applications that do not support modern authentication methods to be compatible with OAuth. The authenticated user is passed to the backend application via HTTP headers, the application can trust this header value and not further authenticate users.

Filename: 000-default.conf

# Filename: /etc/apache2/sites-available/000-default.conf
# Apache2 config with mod_auth_openidc for authenticating users with Google OAuth SSO

ServerName localhost
ErrorLog    /dev/stderr
CustomLog   /dev/stdout combined
TransferLog /dev/stdout

# Expose minimal details in server header
ServerTokens ProductOnly

# Apache security settings HSTS, CSP, X-XSS-Protection, X-Frame-Options, X-Content-Type-Options, Referrer-Policy
# See: https://webdock.io/en/docs/how-guides/security-guides/how-to-configure-security-headers-in-nginx-and-apache
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header set X-XSS-Protection "1; mode=block"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin"

<VirtualHost *:80>

  ServerAdmin webmaster@localhost
  DocumentRoot /var/www/html

  # Permit .htaccess
  <Directory "/var/www/html">
    Options -Indexes
    AllowOverride All
  </Directory>

  # If HTTPS is terminated on AWS ELB or CloudFlare Flexible SSL
  # then set HTTPS. This prevents HTTPS redirect loops.
  SetEnvIfNoCase X-FORWARDED-PROTO "^https$" HTTPS
  SetEnvIfNoCase CF-VISITOR "^{\"scheme\":\"https\"}$" HTTPS


  # Authenticate users using Google OAuth
  OIDCProviderMetadataURL https://accounts.google.com/.well-known/openid-configuration
  OIDCClientID TODO_CLIENT_ID.apps.googleusercontent.com
  OIDCClientSecret TODO_CLIENT_SECRET

  OIDCScope "openid email profile"

  OIDCRedirectURI https://app.example.com/.auth_redirect
  OIDCCryptoPassphrase __TODO__RANDOM__SECRET__

  OIDCXForwardedHeaders X-Forwarded-Proto

  # Timeout the session after 24 hours
  OIDCSessionInactivityTimeout 86400
  # Preserve session time as set in the ID token
  OIDCSessionMaxDuration 86400
  # Store session details in the browser's cookie
  OIDCSessionType client-cookie

  # Extract user from user@email.com and set it as REMOTE_USER
  OIDCRemoteUserClaim email ^(.*)@

  <Location />
   AuthType openid-connect
   Require claim hd:example.com
   Require claim hd:example.net
  </Location>

</VirtualHost>

Sample Application: MantisBT

Sample applications: mantisbt can be configured for HTTP basic auth by setting $g_login_method = BASIC_AUTH; in config.php.

To auto create users and populate their email ID, edit core/authentication_api.php and modify the below:

        if( $t_auto_create ) {
                # attempt to create the user

			    # NOTE: add email ID during account auto creation
                # $t_cookie_string = user_create( $p_username, md5( $p_password ) );
			    $t_cookie_string = user_create( $p_username, md5( $p_password ), $p_username . '@' . config_get_global( 'xx_email_domain' ));

				if( $t_cookie_string === false ) {
                        # it didn't work
                        return false;
                }

                # ok, we created the user, get the row again
                return user_get_id_by_name( $p_username );
        }

⚠️ xx_email_domain is a constant defined in config/config_inc.php. If users are authenticated against a single domain (eg example.com), there is no problem. If users are authenticated from multiple domains (eg. example.com, example.net), then this breaks down and some way of extracting the OIDC response from the IdP and using it in this script is required.