Apache, Rails, and REMOTE_USER

I’m currently redeveloping our intranet site at work, rewriting it in Rails. I want to keep authentication as simple as possible, and since the current site is set up to authenticate against our LDAP server using mod_authnz_ldap, I want to keep that setup (and avoid having to build any authentication into the Rails app itself).

I quickly discovered that the REMOTE_USER environment variable, which for a CGI app would contain the username which was authenticated by Apache, doesn’t get passed via the proxying magic to Rails (when run via mongrel or the like). My Google-fu turned up this thread, which has a solution that sets an X-Forwarded-User header to the value of REMOTE_USER. That header gets passed on in the proxied request to the Rails app. Here’s the magic incantation:

RewriteCond %{LA-U:REMOTE_USER} (.+)
RewriteRule . - [E=RU:%1]
RequestHeader add X-Forwarded-User %{RU}e

It put me on the right track, but still wasn’t working. There’s two problems with the solution given there:

read on