{"action":"created","issue":{"url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/69","labels_url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/69/labels{/name}","comments_url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/69/comments","events_url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/69/events","html_url":"https://github.com/pingidentity/mod_auth_openidc/issues/69","id":82676084,"number":69,"title":"Can the mod_auth_openidc be configured to return a Authorization: Bearer header in redirect response?","user":{"login":"bertramn","id":3828133,"avatar_url":"https://avatars.githubusercontent.com/u/3828133?v=3","gravatar_id":"","url":"https://api.github.com/users/bertramn","html_url":"https://github.com/bertramn","followers_url":"https://api.github.com/users/bertramn/followers","following_url":"https://api.github.com/users/bertramn/following{/other_user}","gists_url":"https://api.github.com/users/bertramn/gists{/gist_id}","starred_url":"https://api.github.com/users/bertramn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bertramn/subscriptions","organizations_url":"https://api.github.com/users/bertramn/orgs","repos_url":"https://api.github.com/users/bertramn/repos","events_url":"https://api.github.com/users/bertramn/events{/privacy}","received_events_url":"https://api.github.com/users/bertramn/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-05-30T02:59:17Z","updated_at":"2015-05-30T12:39:51Z","closed_at":null,"body":"I was wondering if mod_auth_openidc can be configured to return a standard `Authorization: Bearer [jwtToken]` Header in the response to the User Agent after the 302 redirect from the Identity Provider?\r\n\r\nI am talking about the mod url mapping configured by `OIDCRedirectURI` : `https://[server]/example/redirect_uri`.\r\n\r\nI can see the jwtToken is sent as a request header `OIDC_access_token` to the protected application but other than the `mod_auth_openidc_session` cookie in the Response to the user agent there is nothing a javascript application running in the user agent can use to make subsequent XHR requests with a standard `Authorization: Bearer` header.\r\n\r\nThis is required when building single page applications such as AngularJS which run solely in the clients browser and need to communicate Authorization context to REST services that may not be protected by the mod_auth_openidc but are capable of validating the JWT against the same issuer.\r\n"},"comment":{"url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/comments/107036359","html_url":"https://github.com/pingidentity/mod_auth_openidc/issues/69#issuecomment-107036359","issue_url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/69","id":107036359,"user":{"login":"bertramn","id":3828133,"avatar_url":"https://avatars.githubusercontent.com/u/3828133?v=3","gravatar_id":"","url":"https://api.github.com/users/bertramn","html_url":"https://github.com/bertramn","followers_url":"https://api.github.com/users/bertramn/followers","following_url":"https://api.github.com/users/bertramn/following{/other_user}","gists_url":"https://api.github.com/users/bertramn/gists{/gist_id}","starred_url":"https://api.github.com/users/bertramn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bertramn/subscriptions","organizations_url":"https://api.github.com/users/bertramn/orgs","repos_url":"https://api.github.com/users/bertramn/repos","events_url":"https://api.github.com/users/bertramn/events{/privacy}","received_events_url":"https://api.github.com/users/bertramn/received_events","type":"User","site_admin":false},"created_at":"2015-05-30T12:39:51Z","updated_at":"2015-05-30T12:39:51Z","body":"Also `Header add / set` will add response headers as per apache documentation http://httpd.apache.org/docs/2.2/mod/mod_headers.html. But I think when this code runs the server side `OIDC_access_token` header is probably already scrubbed.\r\n\r\n**Option 1**\r\nthe mod_auth_openidc would set an environment variable on a per request basis and then one would be able to simply add a directive like this into the apache configuration to return the issued token to the client browser.\r\n\r\n```apache\r\nSetEnvIf Header set Authorization \"Bearer %{OIDCAuthToken}e\" env=OIDCAuthToken\r\n```\r\n\r\n**Option 2**\r\na configuration directive for the module to add an `Authorization: Bearer [token]` header to the response sent back to the client whenever this `mod_auth_openidc_session` cookie is sent would probably be more consistent:\r\n```apache\r\n<Location \"/e\">\r\n  OIDCReturnBearerToken true\r\n  AuthType openid-connect\r\n  ...\r\n</Location>\r\n```\r\n\r\nAre one of these options doable?"}}