zmartzone/mod_auth_openidc

Free

OpenID Certified™ OpenID Connect Relying Party implementation for Apache HTTP Server 2.x

FreeFree tier

Type

Open Source

Visit Website GitHub (38 stars)

About zmartzone/mod_auth_openidc

mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements OpenID Connect 1.x and FAPI 2.x Relying Party functionality. It enables Apache to act as an OpenID Connect Relying Party (RP), relaying end-user authentication to an OpenID Connect Provider (OP) and receiving identity claims. These claims are passed to protected applications via HTTP headers and environment variables, with the REMOTE_USER variable set to the id_token sub claim combined with the OP's Issuer identifier. The module supports custom fine-grained authorization rules based on Apache's Require primitives, clustering via configurable cache backends, and reverse proxy configuration to add OpenID Connect authentication to existing applications without modification. It is available as pre-built binary packages for Debian/Ubuntu and other platforms, with release binaries attached to GitHub Releases.

Key Features

OpenID Certified™ authentication and authorization module for Apache 2.x

Implements OpenID Connect 1.x and FAPI 2.x Relying Party functionality

Relays authentication to any OpenID Connect Provider and receives identity claims

Passes identity claims (id_token and UserInfo) to protected applications via HTTP headers and environment variables

Sets REMOTE_USER to sub@iss format by default

Custom fine-grained authorization rules using Apache's Require primitives based on claims

Clustering support with configurable cache backends for resilience and performance

Reverse proxy capabilities to add OpenID Connect SSO to existing applications without modification

Supports multiple cache backends (e.g., file, memcached, redis) for session storage

Pre-built binary packages available for Debian/Ubuntu and other platforms

Pros & Cons

Pros

OpenID Certified™, ensuring compliance with OpenID Connect standards
Supports both OpenID Connect 1.x and the newer FAPI 2.x specifications
Enables SSO for legacy applications without code changes via reverse proxy mode
Flexible authorization rules based on arbitrary claims using Apache Require directives
Multiple cache backends available for session clustering and high availability
Active open-source project with frequent updates and community support
Free and open source (Apache 2.0 license)

Cons

Limited to Apache HTTP Server 2.x environments only
Requires manual configuration of OpenID Connect Provider metadata and endpoints
No built-in support for multi-tenancy or tenant-specific OIDC configurations
Documentation is primarily technical and may require familiarity with Apache modules

Best For

Adding OpenID Connect-based Single Sign-On (SSO) to legacy applications hosted behind ApacheProtecting Apache-hosted web applications with standards-based authentication and fine-grained authorizationMigrating from legacy authentication mechanisms to OpenID Connect without modifying application codeDeploying a reverse proxy with OpenID Connect authentication for multiple backend servicesClustered web server environments requiring shared authentication sessions

FAQ

How do I install mod_auth_openidc?

On Debian/Ubuntu, use 'apt install libapache2-mod-auth-openidc'. Pre-built binary packages for other platforms are listed in the project Wiki, and release binaries are attached to GitHub Releases. To build from source, run './configure --with-apxs=/usr/bin/apxs2', then 'make' and 'sudo make install'.

What is the license for mod_auth_openidc?

The module is open source and licensed under the Apache 2.0 license (see LICENSE.txt in the repository).

Does mod_auth_openidc support clustering?

Yes, clustering for resilience and performance can be configured using one of the supported cache backends (e.g., file, memcached, redis). See the module's documentation for details.

How does mod_auth_openidc pass identity information to applications?

It sets the REMOTE_USER variable to the id_token sub claim concatenated with the OP's Issuer identifier (sub@iss). Other id_token and UserInfo claims are passed via HTTP headers and/or environment variables to the protected application.