remote_user_claim option does not work

[salpcnsi]

I am using following introspect options:

OAuth2TokenVerify introspect https://xxx.example.com/mga/sps/oauth/oauth20/introspect remote_user_claim=username&introspect.ssl_verify=false&introspect.auth=client_secret_basic&client_id=xxxxxx&client_secret=yyyyy

I am expecting it to use "username" for remote user claim, but it keeps looking for "sub" claim.

[Mon Oct 10 09:46:27.272556 2022] [oauth2:error] [pid 2347286:tid 140490116687616] [client 73.145.134.132:0] oauth2_apache_set_request_user: remote user claim "sub" could not be found
[Mon Oct 10 09:46:27.272564 2022] [oauth2:debug] [pid 2347286:tid 140490116687616] src/server/apache.c(364): [client 73.145.134.132:0] oauth2_apache_return_www_authenticate: enter
[Mon Oct 10 09:46:27.272573 2022] [oauth2:debug] [pid 2347286:tid 140490116687616] src/server/apache.c(456): [client 73.145.134.132:0] oauth2_apache_hdr_out_add: WWW-Authenticate: Bearer error="invalid_token", error_description="Could not determine remote user."

[zandbelt]

you'll need to use OAuth2TargetPass to set the remote_user_claim option, see:
https://github.com/zmartzone/mod_oauth2/blob/master/oauth2.conf#L138-L150

[salpcnsi]

Thanks for a quick reply.

I got it to work by adding:

OAuth2TargetPass remote_user_claim=username

This was added in addition to :
OAuth2TokenVerify introspect https://xxx.example.com/mga/sps/oauth/oauth20/introspect introspect.ssl_verify=false&introspect.auth=client_secret_basic&client_id=xxxxxx&client_secret=yyyyy

Thanks again for a very quick reply.