mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
b0856dcf7b
Snipe-IT v8.8.1 refuses any `login_remote_user_header_name` matching `/^HTTP_/i`, so the configured `HTTP_X_FORWARDED_PREFERRED_USERNAME` stopped minting sessions behind oauth2-proxy. Apache in the image now copies `X-Forwarded-Preferred-Username` into the server variable `INFINITO_SSO_USER`, and only when the request also carries `X-Infinito-Sso-Proxy` equal to the new per-inventory `sso_proxy_secret`; an empty secret keeps the bridge closed. openresty sends that header on every proxied request, so a client reaching the container directly cannot log in by forging the identity header. A deploy-time check asserts both directions (forged 200, with secret 302). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
8 lines
461 B
Docker
8 lines
461 B
Docker
ARG SNIPE_IT_IMAGE
|
|
ARG SNIPE_IT_VERSION
|
|
FROM ${SNIPE_IT_IMAGE}:${SNIPE_IT_VERSION}
|
|
|
|
RUN sed -i 's#php artisan migrate --force#php artisan migrate --force --isolated#' /startup.sh
|
|
|
|
RUN printf 'SetEnvIf X-Forwarded-Preferred-Username "^(.+)$" INFINITO_SSO_USER=$1\nSetEnvIfExpr "-z env(\047INFINITO_SSO_PROXY_SECRET\047) || req(\047X-Infinito-Sso-Proxy\047) != env(\047INFINITO_SSO_PROXY_SECRET\047)" !INFINITO_SSO_USER\n' > /etc/apache2/conf.d/infinito-sso.conf
|