Disclaimer: I never worked on Apache HTTPD server.

Software used: httpd:2.4, debian:buster-slim

Earlier we were setting SSL_CLIENT_S_DN_CN, SSL_CLIENT_S_DN_OU, SSL_CLIENT_S_DN_O through the DB call when we were using Basic authentication like below.

Note: Certificate details are stored in DB.

<Location "/"> AuthType Basic

AuthName "Secure Area"

AuthBasicProvider dbd

Require valid-user

AuthDBDUserPWQuery "SELECT password, cn as SSL_CLIENT_S_DN_CN, ou as SSL_CLIENT_S_DN_OU, o as SSL_CLIENT_S_DN_O from dbo.****** where userName = %s"

Redirect permanent "/redirect" "https://<>"

In case of basic authentication we were passing user name and password as part of URL. Now we are trying to use JWT authentication. JWT token generation and validating the token has been done in one of the Apache module(mod_authnz_jwt.so).

Flow: User enter the Client URL in browser -> Apache HTTPD installed at Client location which redirect call to MW Java application -> Login validation done at MW -> once User validated -> MW call /gettoken to generate token-> MW call /redirect by passing token->token valiodation at HTTPD server and set SSL_CLIENT_S_DN_CN, SSL_CLIENT_S_DN_OU, SSL_CLIENT_S_DN_O before redirecting to Client location.

jwt-login-handler written in mod_authnz_jwt.so

<Location /gettoken>

SetHandler jwt-login-handler

AuthJWTProvider dbd

AuthDBDUserPWQuery "SELECT password, cn as SSL_CLIENT_S_DN_CN, ou as SSL_CLIENT_S_DN_OU, o as SSL_CLIENT_S_DN_O from dbo.USER_CERT_VIEW where userName = %s" --> can not use this as user name is not passing along with URL

<Location /redirect>

AuthType jwt

AuthName "private area"

Require valid-user

#Redirect permanent "/redirect" https://<>

We are able to generate the token(which contains values of username, cn, ou, o)and validating the token. But not able to set the required environment variables which will use by Client to do authorization.

Approaches tried :

1. During token generation, passed CN, OU, O to shell script. But these are available only in shell script not in Apache httpd process. Looks like environment variables set in child process will not pass to parent process.
2. Tried to set env variable in ./bin/envars as export MYENV='myenv' and used PassEnv MYENV. Still no luck.
3. And also tried SetEnv SSL_CLIENT_S_DN_CN ${MYENV}/%{MYENV}. Now value coming as SSL_CLIENT_S_DN_CN="${MYENV}"/"%{MYENV}"

Questions:

1. Is it possible to pass variables from Apache module to httpd.conf file to set env variables? as required details are sending as x-www-form-urlencoded in case of /gettoken
2. Is there any way to set environment variables before redirecting to client location ?

Any suggestions ???