Nginx – Setting REMOTE_USER for Trac in Gunicorn behind Nginx

authenticationgunicornnginxtrac

I want to run Trac in Gunicorn, behind Nginx. Nginx handles user authentication via LDAP (which works), but I can't get the REMOTE_USER passed to Trac.

For uWSGI I would configure Nginx like this (tested and it works):

uwsgi_param REMOTE_USER $remote_user;

For Gunicorn I could not find a similar configuration directive. I have tried setting the header, but it doesn't seem to change anything:

proxy_set_header REMOTE_USER $remote_user;

There is an entry in the Trac wiki about this, noting that "the wsgi entry point does not handle […] authentication", and a workaround to handle Basic Authentication with a local password file, which is not what I need. Do I need to change my entry point to pass this REMOTE_USER header to the right environment variable? Currently it's just this:

import sys
import os

sys.stdout = sys.stderr

os.environ['TRAC_ENV'] = '/path/to/my/trac'

import trac.web.main
application = trac.web.main.dispatch_request

Best Answer

Strange one. I got this working by including the this in the nginx config like you mentioned

proxy_set_header REMOTE_USER $remote_user;

Then for the trac.wsgi file this

import trac.web.main
def application(environ, start_application):
    environ['REMOTE_USER'] = environ.get('HTTP_REMOTE_USER')
    return trac.web.main.dispatch_request(environ, start_application)

replaces this

import trac.web.main
application = trac.web.main.dispatch_request

in your trac.wsgi

Apparently there is something about the proceeding 'HTTP_' that messes up trac's auth

I am guessing that the same thing probably could be accomplished by doing the same thing to just the 'HTTP_AUTHORIZATION' request header but I didn't attempt that. So I do not know for sure, all I know is that it works now!

Related Topic