{"action":"created","issue":{"url":"https://api.github.com/repos/Graylog2/graylog2-web-interface/issues/560","labels_url":"https://api.github.com/repos/Graylog2/graylog2-web-interface/issues/560/labels{/name}","comments_url":"https://api.github.com/repos/Graylog2/graylog2-web-interface/issues/560/comments","events_url":"https://api.github.com/repos/Graylog2/graylog2-web-interface/issues/560/events","html_url":"https://github.com/Graylog2/graylog2-web-interface/issues/560","id":26256787,"number":560,"title":"Authenticate using REMOTE_USER from web application container","user":{"login":"sigmaris","id":256988,"avatar_url":"https://avatars.githubusercontent.com/u/256988?v=3","gravatar_id":"","url":"https://api.github.com/users/sigmaris","html_url":"https://github.com/sigmaris","followers_url":"https://api.github.com/users/sigmaris/followers","following_url":"https://api.github.com/users/sigmaris/following{/other_user}","gists_url":"https://api.github.com/users/sigmaris/gists{/gist_id}","starred_url":"https://api.github.com/users/sigmaris/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sigmaris/subscriptions","organizations_url":"https://api.github.com/users/sigmaris/orgs","repos_url":"https://api.github.com/users/sigmaris/repos","events_url":"https://api.github.com/users/sigmaris/events{/privacy}","received_events_url":"https://api.github.com/users/sigmaris/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Graylog2/graylog2-web-interface/labels/feature","name":"feature","color":"006b75"},{"url":"https://api.github.com/repos/Graylog2/graylog2-web-interface/labels/security","name":"security","color":"fef2c0"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2014-01-24T17:29:27Z","updated_at":"2015-10-08T12:47:06Z","closed_at":null,"body":"It would be great to be able to authenticate to Graylog2 using (e.g.) the REMOTE_USER variable filled in by Apache when a user authenticates using one of Apache's authentication models. This allows some single-sign-on implementations (e.g. using client certs or Kerberos) that would otherwise not be possible with username/password authentication.\r\n\r\nI can expand on this by explaining our current setup with some of our other internal applications. With these, we run Apache with mod_auth_kerb installed, as the web server for the application. Apache mod_auth_kerb will try and authenticate users with SPNEGO, and then fill in the REMOTE_USER variable with the user's Kerberos principal. The web application then reads / trusts the REMOTE_USER variable from Apache and queries our LDAP server for info about the user's name, email and groups membership. We also use the SPNEGO support in [Tomcat](http://tomcat.apache.org/tomcat-7.0-doc/windows-auth-howto.html) for doing the same thing for servlet-based applications.\r\n\r\nIf Graylog2 could take the 'query LDAP using REMOTE_USER' approach that would be the best option, but also just taking the REMOTE_USER provided by Apache and logging in or creating a user in Graylog2's internal database (instead of querying LDAP) would be nice."},"comment":{"url":"https://api.github.com/repos/Graylog2/graylog2-web-interface/issues/comments/146527674","html_url":"https://github.com/Graylog2/graylog2-web-interface/issues/560#issuecomment-146527674","issue_url":"https://api.github.com/repos/Graylog2/graylog2-web-interface/issues/560","id":146527674,"user":{"login":"akrus","id":36325,"avatar_url":"https://avatars.githubusercontent.com/u/36325?v=3","gravatar_id":"","url":"https://api.github.com/users/akrus","html_url":"https://github.com/akrus","followers_url":"https://api.github.com/users/akrus/followers","following_url":"https://api.github.com/users/akrus/following{/other_user}","gists_url":"https://api.github.com/users/akrus/gists{/gist_id}","starred_url":"https://api.github.com/users/akrus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/akrus/subscriptions","organizations_url":"https://api.github.com/users/akrus/orgs","repos_url":"https://api.github.com/users/akrus/repos","events_url":"https://api.github.com/users/akrus/events{/privacy}","received_events_url":"https://api.github.com/users/akrus/received_events","type":"User","site_admin":false},"created_at":"2015-10-08T12:47:06Z","updated_at":"2015-10-08T12:47:06Z","body":":+1: "}}