Luke Meyer of Red Hat reports:
Description of problem:
The remote-user auth plugin provides an httpd config file intended to require
authentication before setting the REMOTE_USER env var which is passed on to
the plugin. However there are passthrough provisions for other forms of auth;
in particular, the management console is allowed to set the X-Remote-User
header on a request and have that transmuted to the REMOTE_USER env var (by
virtue of being a non-proxied local request). When the REMOTE_USER env var is
set, the remote-user plugin automatically trusts it. By combining the
X-Remote-User header with one of the other passthrough triggers, any user can
be impersonated without authenticating at all.
Additional info:
Simple workaround: add this in the host httpd conf global config, e.g. at the
end of /etc/httpd/conf.d/000002_openshift_origin_broker_proxy.conf:
RequestHeader unset X-Remote-User
Mitigation:
add this in the host httpd conf global config, e.g. at the
end of /etc/httpd/conf.d/000002_openshift_origin_broker_proxy.conf:
RequestHeader unset X-Remote-User