0

I am using this answer to do authentication for an apache reverse proxy to gerrit. However, I'd like to add a second domain as well -- so authenticate either against foo.com or bar.com (both of which are google apps domains so google is used for both).

I've tried several obvious things like adding multiple OIDCAuthRequestParams lines and then adding several Require statements [Require claim hd:foo.com Require claim hd:bar.com] it just accepts the first one I list and ignores the second domain. When I try to add a comma separated list, it just allows all domains in (ie OIDCAuthRequestParams=foo.com, bar.com). In fact the Require statements don't seem to anything, only the OIDCAuthRequestParams seems to work and only for one domain. Any ideas on how I can make two different domains work given the set up for gerrit as listed above?

I'm using apache2.4 Ubuntu 15.10 and libapache2-mod-auth-openidc 1.6.0 Thanks.

Community
  • 1
Trimbee
  • 53
  • 1
  • 8

1 Answers1

0

Those who are following the gerrit example, what worked for me was to not have a OIDCAuthRequestParams line at all, add the Require claim hd: lines that I needed AND remove the Require valid-user line. If I don't remove the Require valid-user it will allow any google domain including gmail.com.

Trimbee
  • 53
  • 1
  • 8