Dynamic header values for authentication of users

[Frankynov]

Hello,
First, thank you for Zoraxy, it's very nice and easy to use ! :)
I am exploring a bit the world of headers, mainly to be able to delegate Navidrome authentication with Zoraxy, in duo with OIDC authentication with Pocket ID.
It seems to work, but so far only if I set a X-Forwarded-User header with a hardcoded username (e.g: franky)
If I try to put something else (like preferred_username or {preferred_username}), it will login but create a new userid with preferred_username.
Therefore I think I am missing the way to dynamically get the value of the username returned by pocket id and to inject it dynamically to the custom header.
Unfortunately I couldn't find any information about it in the wiki : https://github.com/tobychui/zoraxy/wiki/Custom-Headers

Is it possible to achieve what I want to do ?

Thank you !

[aazainjan]

Hello, First, thank you for Zoraxy, it's very nice and easy to use ! :) I am exploring a bit the world of headers, mainly to be able to delegate Navidrome authentication with Zoraxy, in duo with OIDC authentication with Pocket ID. It seems to work, but so far only if I set a X-Forwarded-User header with a hardcoded username (e.g: franky) If I try to put something else (like preferred_username or {preferred_username}), it will login but create a new userid with preferred_username. Therefore I think I am missing the way to dynamically get the value of the username returned by pocket id and to inject it dynamically to the custom header. Unfortunately I couldn't find any information about it in the wiki : https://github.com/tobychui/zoraxy/wiki/Custom-Headers

Is it possible to achieve what I want to do ?

Thank you !

Hi Frankynov,

I believe the issue is that Zoraxy's custom-header variables currently don't expose OIDC claims.

The current Zoraxy documentation lists the supported request-specific variables ($host, $remote_addr, $request_uri, $request_method, $content_type, $http_user_agent, etc.), but preferred_username isn't one of the available variables.

So when you use {preferred_username}, Zoraxy treats it as a literal value rather than resolving it from the Pocket ID/OIDC claims. This matches the behavior you're seeing in Navidrome, where it creates a user literally named preferred_username.

For your setup (Pocket ID → Zoraxy → Navidrome), I don't see a built-in way in the current custom-header implementation to map the OIDC preferred_username claim directly to X-Forwarded-User.

It looks like this would require Zoraxy to expose selected OIDC claims as header variables (for example, something like $oidc_preferred_username) or provide another claim-to-header mapping mechanism.

So I don't think you're missing a configuration option—the functionality appears to be missing from the current custom-header variable set.