Skip to content

Meechum Apache Module EZConfig Options

These properties should be included in your /etc/default/ezconfig file, as needed.

For simple use-cases when terminating TLS/https on an ELB

Property/Values Required/Optional Description
APACHE_MEECHUM = enabled Required Enables the module within ezconfig
APACHE_HTTPS_HOSTNAME = < FQDN_of_application > Required Fully qualified DNS name to your application
APACHE_MEECHUM_CLIENT = < meechum_client_id > Required Meechum client_id
APACHE_MEECHUM_SECRET = /run/metatron/decrypted/my_app_secret Required Metatron encrypted client secret
APACHE_TIMEOUT = 61 Required More info
APACHE_KEEPALIVE = Off Required More info
APACHE_HTTPSLISTENPORT = 443 Optional Default 443
CONFIG_SELECT = $NETFLIX_ENVIRONMENT Optional Allows you to have different configurations per environment.
See: ezconfig environment driven configurations

For simple use-cases when terminating TLS/https on instance

Property/Values Required/Optional Description
APACHE_HTTPS = enabled Required Enables TLS termination within Apache
APACHE_HTTPS_HOSTNAME Required Fully qualified dns name to your application
APACHE_HTTPSLISTENPORT = 7002 Optional Default 7002
APACHE_MEECHUM = enabled Required Enables the module within ezconfig
APACHE_MEECHUM_CLIENT Required Meechum client_id
APACHE_MEECHUM_SECRET Required Meechum client_secet OpenEncrypted
APACHE_TLS_CERT = /set/this/to/your/server.crt Required

Additional Optional Properties

Property/Values Defaults - Required/Optional Description
APACHE_LOCATIONS_FILE = < path to vhost configuration > N/A Ex. /apps/myapp/myappvhost.conf
APACHE_MEECHUM_ADDITIONAL_HOOKS = [iat|access_token|access_token_expires|id_token|userinfo|refresh_token|session] profile The 'profile' data point is provided by the 'additional hooks' parameter. The rest: access_token refresh_token session userinfo - are provided by default. Use this parameter to define additional data points.
APACHE_MEECHUM_ADDITIONAL_SCOPES = "< scopes-separated-by-spaces >" Optional Define additional OpenID Connect scopes that are requested from the Module
By default, applications get the 'default' and '< app_name >' scopes.
APACHE_MEECHUM_AUTH_REQUEST_PARAMS = "auth_strategy=< auth strategy endpoint definition >" Optional Different authentication backends can be specified to allow Partner or Prodicle authentication:
Partner Prod Directory and Netflix Google:
Partner Test Directory and Netflix Google auth:

APACHE_MEECHUM_BLACKLISTEDCLAIMS = < space separated list of claims - e.g: [email|org.supervisor|name] > This allows for blacklisting claims.
APACHE_MEECHUM_CACHE_TYPE = [shm|memcache|redis] redis By default, Meechum will use Amazon's 'Elasticache-backed' managed Redis for session cache, using a shared Redis cluster (which exists in our common regions and accounts).
A different Redis cluster/endpoint can be provided to use a private session cache.
Browser Cookie (shm) or memcache can also be used (see below).
APACHE_MEECHUM_CALLBACK_UNAUTHACTION = [auth|pass|401|410] 401 Similar to APACHE_MEECHUM_UNAUTHACTION, except specifically for the /meechum callback link. This is mainly used to handle the session timeout behavior whilst using the infohook feature off of the callback URI.
APACHE_MEECHUM_COOKIE_DOMAIN = < cookie-domain > $APACHE_HTTPS_HOSTNAME Specify the domain for which the "state" and "session" cookies will be set. This must match the APACHE_HTTPS_HOSTNAME and the URL on which you host your protected application. When not defined the default is the server hostname.
APACHE_MEECHUM_COOKIE_PATH = < cookie-path > "/" server-wide Define the cookie path for the "state" and "session" cookies. When not defined the default is a server-wide "/".
APACHE_MEECHUM_DEFAULTURL = < url > https://${HTTP_HOST} Allows for a user-defined URL. Previously, this was hardcoded to: https://%{HTTP_HOST}/%{REQUEST_URI}
APACHE_MEECHUM_ERROR_TEMPLATE = < filename > N/A Template used to display error messages. The template must be prepared to take two strings, an error title and a more details error description, both HTML encoded values, in that order and referenced by (C-style) "%s", e.g.



. When not defined a bare-bones internal template is used.
Ex. APACHE_MEECHUM_ERROR_TEMPLATE = /apps/myapp/error.html
APACHE_MEECHUM_LOCATIONS = < sso protected paths > ^/ Paths requiring authentication. By default, authenticate everything not explicitly whitelisted in APACHE_PLAINLOCATIONS.
This expression must be in Apache LocationMatch compatible format.
Note that if APACHE_LOCATIONS_FILE is set then APACHE_MEECHUM_LOCATIONS has no effect.
APACHE_MEECHUM_LOGOUT_URL = < url > N/A Defines a default URL where the user is sent to after logout, which may be overridden explicitly during logout. When not defined and no URL was passed explicitly, a default internal page will be shown.
APACHE_MEECHUM_MEMCACHE_SERVER = < hostname >[:] evcache_sso.{region}.dyn{env}
APACHE_MEECHUM_OAUTH_ACCEPT_TOKENS_AS = [header|post|query|cookie[:]+ "header" Define the way(s) in which bearer OAuth 2.0 access tokens can be passed to this Resource Server. Must be one or several of: "header" : an "Authorization: bearer" header "post" : an HTTP Post parameter called "access_token" "query" : as an HTTP query parameter called "access_token" "cookie" : as a cookie header called whatever is specified after ":"
APACHE_MEECHUM_OAUTH_JWKS_URL = < url > default < url > generated by default:
APACHE_MEECHUM_OAUTH_LOCATIONS = < oauth20 protected paths > N/A Paths requiring OAuth authentication. By default, authenticate nothing.
This expression must be in Apache LocationMatch compatible format.
Note that if APACHE_LOCATIONS_FILE is set then APACHE_MEECHUM_OAUTH_LOCATIONS has no effect. Note also that these locations will require the scope matching the OIDCClientID (EZConfig Option APACHE_MEECHUM_CLIENT)
APACHE_MEECHUM_PASS_CLAIMS_AS = [none|headers|environment|both] "headers" Define the way in which the claims and tokens are passed to the application environment:
"none": no claims/tokens are passed
"environment": claims/tokens are passed as environment variables
"headers": claims/tokens are passed in headers (also useful in reverse proxy scenario's)
"both": claims/tokens are passed as both headers as well as environment variables (default)
When not defined the default is "both". The access token is passed in OIDC_access_token; the access token expiry is passed in OIDC_access_token_expires. The refresh token is only passed in OIDC_refresh_token if enabled for that specific directory/location (see: APACHE_MEECHUM_PASS_REFRESH_TOKEN)
List of attributes/claims
APACHE_MEECHUM_PASS_REFRESH_TOKEN = [On|Off] Off Indicates whether the refresh token will be passed to the application in a header/environment variable
APACHE_MEECHUM_PASSCOOKIES = [ < cookie-name > ]+ N/A Specify the names of cookies to pickup from the browser and send along on backchannel calls to the OP and AS endpoints. This can be used for load-balancing purposes. When not defined, no such cookies are sent.
APACHE_MEECHUM_REDIS_SERVER = < hostname >[:] sso-cache.{region}.meechum.{env}
APACHE_MEECHUM_SCRUB_REQUEST_HEADERS = [On|Off] "On" Scrub user name and claim headers (as configured above) from the user's request. The default is "On"; use "Off" only for testing and debugging because it renders your system insecure.
APACHE_MEECHUM_SESSION_INACTIVITY_TIMEOUT = < seconds > 3600 (seconds) Interval in seconds after which the session will be invalidated when no interaction has occurred.
APACHE_MEECHUM_SESSION_MAX_DURATION = < seconds > 7100 (seconds) Maximum duration of the application session
APACHE_MEECHUM_UNAUTHACTION = [auth|pass|401|410] auth Defines the action to be taken when an unauthenticated request is made.
"auth" means that the user is redirected to the OpenID Connect Provider or Discovery page.
"401" means that HTTP 401 Unauthorized is returned.
"410" means that HTTP 410 Gone is returned
"pass" means that an unauthenticated request will pass but claims will still be passed when a user happens to be authenticated already
Useful in Location/Directory/Proxy path contexts that serve AJAX/Javascript calls and for "anonymous access"
APACHE_MEECHUM_USERINFOREFRESHINTERVAL = < seconds > 900 (seconds) Automatic return of claims every 900 seconds(15 minutes).
APACHE_MEECHUM_WHITELISTEDCLAIMS = < space separated list of claims - e.g: [email|org.supervisor|name] > This allows for whitelisting of claims - Mainly to help reduce header sizes by giving the developer some control over what is passed. Please note that when a claim is whitelisted, it blacklists ALL OTHER CLAIMS. Also note that the access token is whitelisted regardless.
APACHE_PLAIN_LOCATIONS = < unprotected paths > ^/(healthcheck|Admin(Proxy(Status|Info)|Logs|GCViz)) Paths that are allowed over HTTP (and without Meechum auth if enabled).
Note that the Admin URLs are IP whitelisted.
This expression must be in Apache LocationMatch compatible format.
Note that if APACHE_LOCATIONS_FILE is set then APACHE_PLAIN_LOCATIONS has no effect.
Ex. APACHE_PLAIN_LOCATIONS = ^/(healthcheck|Admin(Proxy(Status|Info)|Logs|GCViz))
APACHE_PROXY = [ajp|http] ajp Defines the protocol for use to proxy connections to a Tomcat application. AJP is the default protocol. When using EZConfig, any existing Tomcat 'server.xml' configuration will get overwritten to support the protocol and the port defined in TOMCAT_HTTPPORT.
TOMCAT_HTTPPORT= < tomcat listen port > 8009 The application listener port. It can be changed to suit your application port, regardless if it's Tomcat.

More options: