Fixes an issue where variants of an externally authenticated user

X_REMOTE_USER can be specified for access to the API. This assures that X-Remote-User, X-Remote_User as well as X_Remote-User are also cleared from an inbound request thus restricting all X[-_]REMOTE[-_]USER signatures for External Authentication.
ManageIQ · Jul 1, 2020 · 3ff329a · 3ff329a
1 parent 181f07b
commit 3ff329a
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/TEMPLATE/etc/httpd/conf.d/manageiq-remote-user-openidc.conf b/TEMPLATE/etc/httpd/conf.d/manageiq-remote-user-openidc.conf
@@ -1,3 +1,6 @@
+RequestHeader unset X-REMOTE-USER
+RequestHeader unset X-REMOTE_USER
+RequestHeader unset X_REMOTE-USER
 RequestHeader unset X_REMOTE_USER
 
 RequestHeader set X_REMOTE_USER           %{OIDC_CLAIM_PREFERRED_USERNAME}e      env=OIDC_CLAIM_PREFERRED_USERNAME

diff --git a/TEMPLATE/etc/httpd/conf.d/manageiq-remote-user.conf b/TEMPLATE/etc/httpd/conf.d/manageiq-remote-user.conf
@@ -1,3 +1,6 @@
+RequestHeader unset X-REMOTE-USER
+RequestHeader unset X-REMOTE_USER
+RequestHeader unset X_REMOTE-USER
 RequestHeader unset X_REMOTE_USER
 
 RequestHeader set X_REMOTE_USER           %{REMOTE_USER}e           env=REMOTE_USER