mod_auth_openidc and mod_auth_mellon: Status, Alternatives and Migration

The Web Agent is an Apache module built on the server that runs it, against that server’s own headers.

It brings sign-in policy, MFA and the Oracle header profile to Apache 2.4, Apache 2.2 and Oracle HTTP Server (11g and 12c R1 are Apache 2.2, 12c R2 is Apache 2.4). It has three modes:

Three capabilities set the Web Agent apart:

• Built for Oracle applications. By default the agent upper-cases the user name and sends the legacy headers Oracle E-Business Suite, PeopleSoft, JD Edwards, Hyperion and Siebel look for. One setting sends the identity unchanged for any other application. See Oracle HTTP Server SSO.
• Policy and MFA in front of Apache. In SSOGEN mode, the same assignment, authentication policy and step-up rules apply as for every other application. The application itself does not change. See MFA software.
• Headers the browser cannot forge. On every request, including paths set to SSOGENProtection off, the agent first strips any identity headers the browser sent, then adds the real ones.

A site looks like this, with placeholders only:

LoadModule ssogen_module modules/mod_ssogen.so

<VirtualHost *:443>
    ServerName ebs.acme.example
    SSOGENMode           ssogen
    SSOGENServerURL      https://sso.acme.example
    SSOGENClientURL      https://ebs.acme.example
    SSOGENClientId       <client id from the console>
    SSOGENSessionSecret  <same value on every node>
    <Location />
        SSOGENProtection on
    </Location>
</VirtualHost>

The console generates this block on the application’s Integration tab.

Your browser generates the session secret and never sends it to SSOGEN. Use the same secret on every web server, so that every node can read the session cookie.

• Protection. It starts when you set SSOGENProtection to on or optional; loading the module alone changes nothing.
• Sign-in methods. LDAP and database sign-in run in SSOGEN, not in the module, so the module has no LDAP or database modes.
• Build. You build it from the source bundle rather than a packaged installer.
• Setup guide. The full procedure is in the Web Agent setup guide.

The directive names differ, but the concepts line up.

Directives for the two open-source modules come from their READMEs (read 2026-10-11). The Web Agent’s standalone modes are SSOGENMode saml and SSOGENMode oidc.

Steps for a move, on a test virtual host first:

1. List the protected paths and the attribute or claim your application reads as the user name.
2. Register the application with the provider using the Web Agent’s addresses. The ACS URL is normally https://<app-host>/ssogen/acs; the OpenID Connect redirect URI is normally https://<app-host>/ssogen/oidc/callback.
3. Set SSOGENMode explicitly. The module does not start if any SSOGENSaml* or SSOGENOidc* directive is present without it.
4. Enter the license key, then compare the headers and variables the application receives with what it got before. For Oracle applications, keep the default application setting; it adds the headers those applications expect.
5. Check logout and the session timeouts. Each module has different defaults.

Plan the move as a configuration change, not a drop-in swap: the mapping above covers the common directives, not every one.

If SSOGEN is your identity provider, SSOGENMode ssogen is the default and needs no license key. See protect an on-premise application with the Web Agent.