mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
kevinveenbirkenbachandClaude Opus 5.5
b0856dcf7b
Snipe-IT v8.8.1 refuses any `login_remote_user_header_name` matching `/^HTTP_/i`, so the configured `HTTP_X_FORWARDED_PREFERRED_USERNAME` stopped minting sessions behind oauth2-proxy. Apache in the image now copies `X-Forwarded-Preferred-Username` into the server variable `INFINITO_SSO_USER`, and only when the request also carries `X-Infinito-Sso-Proxy` equal to the new per-inventory `sso_proxy_secret`; an empty secret keeps the bridge closed. openresty sends that header on every proxied request, so a client reaching the container directly cannot log in by forging the identity header. A deploy-time check asserts both directions (forged 200, with secret 302). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
23 lines
905 B
PHP
23 lines
905 B
PHP
<?php
|
|
// nocheck: mirrored-unit-test - boots Snipe-IT's Laravel kernel through
|
|
// bootstrap/app.php and writes the trusted-reverse-proxy login settings through
|
|
// App\Models\Setting; the models only exist once the install has booted
|
|
require "vendor/autoload.php";
|
|
$app = require "bootstrap/app.php";
|
|
$app->make(Illuminate\Contracts\Console\Kernel::class)->bootstrap();
|
|
|
|
use App\Models\Setting;
|
|
|
|
$s = Setting::getSettings();
|
|
|
|
$remote_user_enabled = (getenv("SNIPE_IT_SSO_ENABLED") === "1") ? 1 : 0;
|
|
$remote_user_header_name = getenv("SNIPE_IT_SSO_HEADER_NAME") ?: "REMOTE_USER";
|
|
$remote_user_logout_url = getenv("SNIPE_IT_SSO_LOGOUT_URL") ?: "";
|
|
|
|
$s->login_remote_user_enabled = $remote_user_enabled;
|
|
$s->login_remote_user_header_name = $remote_user_header_name;
|
|
$s->login_remote_user_custom_logout_url = $remote_user_logout_url;
|
|
$s->login_common_disabled = 0;
|
|
|
|
$s->save();
|