title: Apache as ReverseProxy with authentication OAuth2.0 and check
body: <p>I configured Apache 2.4 on CentOS 7 as reverse proxy with authentication OAuth 2.0 with google.
  this is my <strong>http.conf</strong> file:</p>
  
  <pre><code>ProxyRequests off
  
  &lt;Proxy *&gt;
          Order deny,allow
          Deny from all
          Allow from all
  &lt;/Proxy&gt;
  ProxyTimeout 300
  
  &lt;VirtualHost test.mydomain.com:80&gt;
      ServerName test.mydomain.com
      Redirect / https://test.mydomain.com/
  &lt;/VirtualHost&gt;
  
  &lt;VirtualHost test.mydomain.com:443&gt;
      ServerName test.mydomain.com
      SSLEngine on
      SSLCertificateFile /etc/httpd/ssl/mydomain.crt
      SSLCertificateKeyFile /etc/httpd/ssl/mydomain.key
      SSLCACertificateFile /etc/httpd/ssl/gd_bundle-g2-g1.crt
  
      ErrorLog /var/www/html/test_error.log
      CustomLog /var/www/html/test_access.log combined
  
      OIDCProviderMetadataURL https://accounts.google.com/.well-known/openid-configuration
      OIDCClientID xxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com
      OIDCClientSecret xxxxxxxxxxxxxxxxxxxxxxx
      OIDCRedirectURI https://test.mydomain.com/index.php
      OIDCScope "profile openid"
      OIDCCryptoPassphrase example@3003
      OIDCCookiePath /
      OIDCAuthNHeader X-Forwarded-User
      OIDCRemoteUserClaim sub
      OIDCClaimPrefix example_
  
      &lt;Location /&gt;
          AuthType openid-connect
          Require valid-user
      &lt;/Location&gt;
  
      ProxyPreserveHost On
      ProxyPass / http://192.168.1.1:5563/
      ProxyPassReverse / http://192.168.1.1:5563/
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>Now, when I digit <a href="https://test.mydomain.com" rel="nofollow noreferrer">https://test.mydomain.com</a> I redirect to google authentication and after (if the login is ok) to the reverse resource on <a href="http://192.168.1.1:5563/" rel="nofollow noreferrer">http://192.168.1.1:5563/</a></p>
  
  <p>Now I'm trying to create a custom login page in PHP, because I would check if the user can access (because with Google OAuth all member of domain can access) or not to this remote resource <a href="http://192.168.1.1:5563/" rel="nofollow noreferrer">http://192.168.1.1:5563/</a> and I created my <strong>index.php</strong> page:</p>
  
  <pre><code>&lt;?php
  session_start();
  include('config/config.php');
  $login_button = '';
  
  //This $_GET["code"] variable value received after user has login into their Google Account redirct to PHP script then this variable value has been received
  if(isset($_GET["code"]))
  {
  // ... set session variable ...
  }
  
  //This is for check user has login into system by using Google account, if User not login into system then it will execute if block of code and make code for display Login link for Login using Google account.
  if(!isset($_SESSION['access_token']))
  {
   //Create a URL to obtain user authorization
  $login_button = '&lt;a href="'.$google_client-&gt;createAuthUrl().'"&gt;&lt;img src="images/sign-in-with-google.png" /&gt;&lt;/a&gt;';
  $_SESSION['logged'] = false;
   }
  ?&gt;
  &lt;html&gt;
   &lt;head&gt;
    &lt;meta http-equiv="Content-Type" content="text/html; charset=utf-8" /&gt;
    &lt;title&gt;Log in/Sign up screen&lt;/title&gt;
   &lt;/head&gt;
   &lt;body&gt;
    &lt;div class="container"&gt; 
     &lt;div class="frame"&gt;
      &lt;div ng-app ng-init="checked = false"&gt;
          &lt;h1&gt;&lt;img align="center" src="images/logo_rouded.png" width="100" height="auto"&gt;&lt;/h1&gt;
       &lt;?php
              if($login_button == '')
              {
                  echo "&lt;form class=\"form-signin\" action=\"\" method=\"post\" name=\"form\"&gt;";
                  echo "&lt;p align=\"center\"&gt;Select your enviroment&lt;/p&gt;";
  
                  echo "&lt;div class=\"btn-animateOscar\"&gt;";
                  echo "&lt;a class=\"btn-signin\" onclick=\"window.open('test.php','popUpWindow','height=650,width=1000,left=100,top=100,resizable=yes,scrollbars=yes,toolbar=yes,menubar=no,location=no,directories=no, status=yes')\"&gt;test&lt;/a&gt;";
                  echo "&lt;/div&gt;";
  
                  echo "&lt;div class=\"btn-animate_signout\"&gt;";
                  echo "&lt;a class=\"btn-signin\" href=\"logout.php\"&gt;Sign out&lt;/a&gt;";
                  echo "&lt;/div&gt;";
                  echo "&lt;/form&gt;";
              } else {
                  echo "&lt;p align=\"center\"&gt;Sign in with Activo Account&lt;/p&gt;";
                  echo '&lt;div align="center"&gt;'.$login_button . '&lt;/div&gt;';
              }
              ?&gt;     
            &lt;/div&gt; 
      &lt;/div&gt;
     &lt;/div&gt;
   &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>And <strong>test.php</strong> that I call with href is:</p>
  
  <pre><code>&lt;?php
  session_start();
  ?&gt;
  &lt;html&gt;
   &lt;head&gt;
    &lt;meta http-equiv="Content-Type" content="text/html; charset=utf-8" /&gt;
    &lt;title&gt;TEST&lt;/title&gt;
    &lt;meta content='width=device-width, initial-scale=1, maximum-scale=1' name='viewport'/&gt;
   &lt;/head&gt;
   &lt;body&gt; 
           &lt;?php    
                  if(isset($_SESSION['logged']) &amp;&amp; $_SESSION['logged']==true){
                      echo "&lt;iframe width=\"100%\" height=\"100%\" src=\"https://test.mydomain.com/TEST\"&gt;&lt;/iframe&gt;";
                  } else {
                      echo "&lt;div class=\"container\"&gt;";
                          echo "&lt;div class=\"frame\"&gt;";
                              echo "&lt;div ng-app ng-init=\"checked = false\"&gt;";
                                  echo "&lt;h1&gt;&lt;img align=\"center\" src=\"images/logo_rouded.png\" width=\"100\" height=\"auto\"&gt;&lt;/h1&gt;";
                                      echo "&lt;form class=\"form-signin\" action=\"\" method=\"post\" name=\"form\"&gt;";
                                          echo "&lt;p align=\"center\"&gt;You are not login, please login&lt;/p&gt;"; 
                                          echo "&lt;p align=\"center\"&gt;You'll redirect to login page in 5 seconds&lt;/p&gt;";
                                          header('Refresh: 5; url=index.php');
                                      echo "&lt;/form&gt;";
                              echo "&lt;/div&gt;";
                          echo "&lt;/div&gt;";
                      echo "&lt;/div&gt;";
                  }    
              ?&gt;
      &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>And I changed my <strong>http.conf</strong> as below:</p>
  
  <pre><code>&lt;VirtualHost test.mydomain.com:443&gt;
          ServerName test.mydomain.com
          SSLEngine on
          SSLCertificateFile /etc/httpd/ssl/mydomain.com.crt
          SSLCertificateKeyFile /etc/httpd/ssl/mydomain.com.key
          SSLCACertificateFile /etc/httpd/ssl/gd_bundle-g2-g1.crt
          DocumentRoot /var/www/html/googleaccess/
          DirectoryIndex index.php
  
  &lt;Proxy *&gt;
  Order deny,allow
  Allow from all
  &lt;/Proxy&gt;
  
  ProxyRequests On
  ProxyPass /TEST http://192.168.1.1:5563/ts/ts2/index.html
  ProxyPassReverse /TEST http://192.168.1.1:5563/ts/ts2/index.html
  
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>Now the problem is:
  1) the reverse proxy doesn't work correctly (I think that is a bad configuration in http.conf)
  2) If I digit <a href="https://test.mydomain.com/TEST" rel="nofollow noreferrer">https://test.mydomain.com/TEST</a> I jump the google authentication, how can I block this?
  3) I can't enable the traffic form all network to <a href="http://192.168.1.1:5563/ts/ts2/index.html" rel="nofollow noreferrer">http://192.168.1.1:5563/ts/ts2/index.html</a>, for this reason I must use a reverse proxy.</p>
  
  <p>Thanks for the help</p>