add regex replacement in OIDCOAuthRemoteUserClaim

[demoze]

Hi everyone,

I would like to modify claim value that is used when setting the REMOTE_USER variable.
My claim value has the folowing form client_id : "xxx-aa_bb_cc-zzz" and I want it to be "aa-bb-cc" in REMOTE_USER.

The middle part can be any number of consecutif characteres separat by "_".

I can use an expression like
OIDCOAuthRemoteUserClaim client_id ^cli-([^-]+)-.+$
to filter out the prefix and suffix, but I can't figure it how to replace "_" by "-".

Could we have regex replace in OIDCOAuthRemoteUserClaim directive for the next release or a patch ? ;-)

Thank for your feedback

[zandbelt]

it is already supported #292

[demoze]

Thank,

yes I saw the substitution-string option. it work very well if the input pattern is fixed.
OIDCOAuthRemoteUserClaim client_id ^cli-([^_]+)_([^_]+)_([^_]+)-.+$ $1-$2-$3

I can easily strip xx- and -zzz parts

BUT what if the pattern could be

"xxx-aa_bb_cc-zzz"         --> "aa-bb-cc"
"xxx-aa_bb_cc-ddd-zzz"     --> "aa-bb-cc-dd"
"xxx-aa_bb-zzz"            --> "aa-bb"
"xxx-aa-zzz"               --> "aa"

is there a way to blindly replace "_" by "-" ?

[zandbelt]

I'm guessing there is (probably using a logical OR), but it is more of a regular expression question than a mod_auth_openidc question.

[demoze]

yep I could easily do it for my use case with
OIDCOAuthRemoteUserClaim client_id ^(?:[^-]+-)([^_-]+)(_)?([^_-]+)?(_)?([^_-]+)?(_)?([^_-]+)?(?:-.+)$ $1${2:+-:}${3:+$3:}${4:+-:}${5:+$5:}${6:+-:}${7:+$7:}

Unfortunatly its a PCRE2 syntax :-(

I keep searching... )