title: Yet another Apache Reverse Proxy and mod_rewrite challenge
body: <p>I have a web UI behind a firewall that employs "simple" authentication (Hadoop JobTracker UI).  This means the URL includes the name of the user as a parameter, and the web server trusts the browser is who it says it is.  It listens on a non-standard port (50030) and doesn't have any "application" identifier (so the URI portion is effectively random).
  Hence, my target URL might be something like: <code>https://actual_web_server:50030/jobqueue_details.jsp?queueName=default&amp;User.Name=foo</code></p>
  
  <p>To complicate things:</p>
  
  <ul>
  <li>I want to employ Apache as a reverse proxy, to reduce the number of holes in my firewall.</li>
  <li>I want Apache to authenticate the user (i.e. against LDAP).</li>
  <li>I want to provide a nice URL to our end users to differentiate between the several different Hadoop clusters I have.</li>
  <li>I have to employ encryption.</li>
  </ul>
  
  <p>Hence, I am hoping to have the above URL presented on the browser as:
  <code>https://JobTracker.Cluster1.MySite.com/jobqueue_details.jsp?queueName=default</code></p>
  
  <p>I am hoping that I can configure Apache to:</p>
  
  <p>1) Authenticate incoming connections against LDAP using mod_authnz_ldap
  (<a href="http://httpd.apache.org/docs/current/mod/mod_authnz_ldap.html" rel="nofollow">as per here</a>.)  This looks relatively straight forward with lots of examples, think I can handle this bit!</p>
  
  <p>2) Use a DNS entry (JobTracker.Cluster1.MySite.com) and a virtual host entry on Apache to enable the prettier URL.  Again, not the real challenge, but complicates the configuration.</p>
  
  <p>3) Employ mod_rewrite to:</p>
  
  <p>3a) Remove the "User.Name=foo" parameter if the user has supplied it, as we can't trust the value they supply.</p>
  
  <p>3b) Add in the Parameter "User.Name={Authenticated LDAP Username}" to the URL.</p>
  
  <p>3c) Replace the pretty hostname and port (JobTracker.Cluster1.MySite.com) with the target hostname and port (actual_web_server:50030) </p>
  
  <p>3d) Proxy the request to the target web server using this new URL</p>
  
  <p>3e) The URL shown in the browser (and for any links on the page) are also modified to use the correct "pretty" hostname.</p>
  
  <p>3f) Ideally, the URL shown in the browser has the "User.Name=foo" parameter NOT shown.  It's not a big drama if it is shown, but I'd rather not.</p>
  
  <p>Note I cannot simply redirect as I can't have direct connectivity from the browser to "actual_web_server".  Also, this one Apache installation will serve multiple web UIs configured identically to this one (custom DNS entry for each).</p>
  
  <p>Hoping someone has "been there, done that" enough to know how, or even if, this is possible.....</p>