Rewrite authenticated Apache2.2 user for mod_proxy_ajp

I have a Tomcat connected via mod_proxy_ajp to an Apache2.2 instance. Apache does the authentication via mod_auth_kerb, and Tomcat uses request.getRemoteUser() to get the authenticated user.

This basically works, but I want to rewrite the user. However, none of the headers I set affect what is returned by request.getRemoteUser(), I only see them as additional headers, what do I have to do?

   # Rewrite Magic: change REMOTE_USER to something Alfresco expects
    RewriteEngine On

    RewriteMap domain_map txt:/etc/apache2/rewrite-map.txt

    # Grab the REMOTE_USER apache environment variable for HTTP forwarding (requires sub-request!)
    RewriteCond %{LA-U:REMOTE_USER} (.*)@(.*)

    # change the format and replace the domain, e.g.: 
    # user@some.domain  ==>  other.domain_user
    RewriteRule . - [E=RU:$开发者_运维知识库{domain_map:%2|%2}_%1]

    # copy processed user to HTTP headers
    RequestHeader set REMOTE_USER %{RU}e
    RequestHeader set HTTP_REMOTE_USER %{RU}e
    RequestHeader set AJP_REMOTE_USER %{RU}e
    RequestHeader set AJP_HTTP_REMOTE_USER %{RU}e

Thanks!

I suspect that the headers are not being set as you expect them to be set, and they are getting to Tomcat empty.

I have experienced some puzzling processing order issues that caused RequestHeader to ignore the environment variables set by a RewriteRule. Take a look at https://stackoverflow.com/a/9303018/239408 in case it helps

It seems the getRemoteUser() value can not be overwritten by Apache header directives, as the AJP protocol handler gets the username from some internal Apache structure. I worked around this by sending the username via http header and modifying the Java code to use that instead of using getRemoteUser().