mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-09-25 01:53:03 +02:00
Pontoporeia
e4b48867aa
- docs: record the open identity-forwarding question, auth contracts, and responsibility boundary
52 lines
1.9 KiB
PHP
52 lines
1.9 KiB
PHP
<?php
|
|
/**
|
|
* echo-headers.php — request-side identity probe for the SSO diagnosis.
|
|
*
|
|
* The ONLY reliable way to see the identity header LemonLDAP injects into the
|
|
* request IT forwards to the backend is to place an endpoint *behind* the same
|
|
* reverse proxy (same vhost as PeerTube) and have it echo the request headers.
|
|
* Response headers on the public site can never reveal this.
|
|
*
|
|
* Deploy this file anywhere served through the SAME LemonLDAP vhost that
|
|
* protects videos.erg.be (e.g. a static location, or a tiny PHP handler on the
|
|
* backend), authenticate at portail.erg.school, then hit it — it returns JSON
|
|
* of every inbound header. Forward the resulting URL to sso-diagnose.sh:
|
|
*
|
|
* scripts/sso-diagnose.sh --echo 'https://videos.erg.be/path/to/echo-headers.php'
|
|
*
|
|
* Output (subset):
|
|
* {
|
|
* "headers": { "X-Remote-User": "jsmith", "Auth-User": "jsmith", ... },
|
|
* "server": { "REMOTE_USER": "...", ... }
|
|
* }
|
|
*
|
|
* It also mirrors the CGI subprocess environment (REMOTE_USER, etc.), which is
|
|
* where Apache/LemonLDAP often land the identity. Safe: emits NO secret — only
|
|
* the incoming headers it was handed.
|
|
*/
|
|
|
|
header('Content-Type: application/json; charset=utf-8');
|
|
header('Cache-Control: no-store');
|
|
|
|
$headers = [];
|
|
foreach ($_SERVER as $k => $v) {
|
|
if (str_starts_with($k, 'HTTP_')) {
|
|
$name = str_replace('_', '-', substr($k, 5));
|
|
$headers[$name] = $v;
|
|
}
|
|
}
|
|
|
|
// Also surface the classic CGI environment identity vars directly.
|
|
$server = [
|
|
'REMOTE_USER' => $_SERVER['REMOTE_USER'] ?? null,
|
|
'AUTH_USER' => $_SERVER['AUTH_USER'] ?? null,
|
|
'PHP_AUTH_USER' => $_SERVER['PHP_AUTH_USER'] ?? null,
|
|
'REDIRECT_REMOTE_USER' => $_SERVER['REDIRECT_REMOTE_USER'] ?? null,
|
|
];
|
|
|
|
echo json_encode([
|
|
'headers' => $headers,
|
|
'server' => $server,
|
|
'remote_addr' => $_SERVER['REMOTE_ADDR'] ?? null,
|
|
], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES);
|