OP-3140: Forward the auth_check identity headers upstream

conf/locations/opensearch.loc

@@ -1,6 +1,7 @@
 
     # Authorizes Dashboards against openIMIS rights, not merely a valid session.
     # 200 right held, 403 right missing, 401 no session -> login.
+    # The 200 also carries X-Auth-User / X-Auth-Rights, copied upstream below.
     location = /check_opensearch/ {
         internal;
         proxy_pass http://${backend}/${REACT_APP_API_URL}/opensearch_reports/auth_check;
@@ -13,6 +14,12 @@
 
     location /opensearch/ {
         auth_request /check_opensearch/;
+        # Identity from the 200, forwarded below. A backend that does not
+        # set them leaves these empty, and nginx then omits the header
+        # entirely rather than sending a blank one - so this gate can land
+        # before the backend that fills it does.
+        auth_request_set $auth_user   $upstream_http_x_auth_user;
+        auth_request_set $auth_rights $upstream_http_x_auth_rights;
         # auth_request can only deny; 403 passes through unchanged.
         error_page 401 = @openimis_login;
 
@@ -22,6 +29,13 @@
         proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header   X-Forwarded-Proto https;
         proxy_set_header   X-Forwarded-Host $server_name;
+        # The cluster's proxy authenticator reads these two under whatever
+        # names its roles_header/user_header are set to, and files the codes
+        # as backend roles. Dashboards relays a header onwards only if it is
+        # listed in opensearch.requestHeadersAllowlist, which these are not
+        # yet - so for now they stop there.
+        proxy_set_header   x-proxy-user $auth_user;
+        proxy_set_header   x-proxy-rights $auth_rights;
         proxy_set_header Authorization "Basic ${OPENSEARCH_BASIC_TOKEN}";
 
     }