title: Apache2 Reverse Proxy with authentication over OpenID Connect and authorization over ldap
body: <p>I'm trying to setup a reverse proxy that requires authentication against an OpenID Connect Identity Provider.</p>
  
  <p>The User then grants the reverse proxy access to his data.</p>
  
  <p>Some applications behind the proxy are only accessible by the user if he is the member of specific LDAP groups. Sadly the applications are the dump and cannot authorize themselves, so the reverse proxy must handle that part.</p>
  
  <p>It wasn't so hard to setup the authentication part with <a href="https://github.com/pingidentity/mod_auth_openidc" rel="nofollow noreferrer">mod_auth_openidc</a>. <strong>What I struggle with is the authorization part</strong>. I have a working example with <a href="https://httpd.apache.org/docs/2.4/mod/mod_authnz_ldap.html#howitworks" rel="nofollow noreferrer">mod_authnz_ldap</a> that requires username and password over <em>BasicAuth</em>.</p>
  
  <p>The idea with OpenID Connect is that Resource Server (the proxy in my case) will never know the user's password and does not have to check it. That is delegated to the OpenID Connect Identity Provider.</p>
  
  <p>So I don't have the password needed for this approach. My idea was to create a virtual host with oidc auth that refuses some header like <code>x-my-oidc-username</code> from clients, sets this header once authenticated and passes the request to another vhost binding on <code>127.0.0.1</code> so it cannot be accessed directly bypassing authentication. That vhost just takes the header as the authenticated username and runs the LDAP authorization.</p>
  
  <p>I haven't seen a way to just skip the <a href="https://httpd.apache.org/docs/2.4/mod/mod_authnz_ldap.html#authenphase" rel="nofollow noreferrer">Authentication Phase</a> of the ldap module and take the username from somewhere else like the OpenID Connect ID Token or from my custom header.</p>
  
  <p>Any ideas/suggestions/approaches/tips?</p>