title: Apache reverse proxy with GSUITE authentication and check OPENLDAP user member of specific group
body: <p>I created a PHP login page with GSUITE authentication.
  After GSuite authentication (because I can't authenticate users for group), I check if the user is member of specific OPENLDAP group, if not I force redirect to login page.
  Now I need for all user authenticated and are member of specific OPENLDAP group to allow access to back-end server using Apache reverse proxy authentication, but I need two step authentication:</p>
  <blockquote>
  <ol>
  <li>The user must be authenticated by GSUITE;</li>
  <li>The user must be member of the specific OPENLDAP group.</li>
  </ol>
  </blockquote>
  <p>Now for the first step I solved in this way:</p>
  <pre><code>&lt;VirtualHost backend.mydomain.local:8443&gt;
          ServerName backend.mydomain.local
  
          SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
          SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
          SSLHonorCipherOrder On
          SSLCompression off
  
          SSLEngine on
          SSLCertificateFile /etc/httpd/ssl/mySSL.crt
          SSLCertificateKeyFile /etc/httpd/ssl/mySSL.key
          SSLCACertificateFile /etc/httpd/ssl/gd_bundle-g2-g1.crt
  
          ErrorLog /var/log/httpd/backend_8443_error.log
          CustomLog /var/log/httpd/backend_8443_access.log combined
  
          OIDCProviderMetadataURL https://accounts.google.com/.well-known/openid-configuration
          OIDCClientID xxxxx.apps.googleusercontent.com
          OIDCClientSecret xxxxx
          OIDCRedirectURI https://backend.mydomain.local:8443/index.php
          OIDCScope &quot;profile openid&quot;
          OIDCCryptoPassphrase example@3003
          OIDCCookiePath /
          OIDCAuthNHeader X-Forwarded-User
          OIDCRemoteUserClaim sub
          OIDCClaimPrefix example_
          OIDCSessionInactivityTimeout 1800
  
          &lt;Location /&gt;
                  AuthType openid-connect
                  Require valid-user
          &lt;/Location&gt;
  
          ProxyPreserveHost On
          ProxyPass / http://192.168.0.20:5563/ connectiontimeout=1800 timeout=1800
          ProxyPassReverse / http://192.168.0.20:5563/
  &lt;/VirtualHost&gt; 
  </code></pre>
  <p>But how can I check if the user is member of specific OPENLDAP group when the user digit directly the url in the browser: <strong>backend.mydomain.local:8443</strong></p>
  <p>Thanks for the support.
  Marco</p>