Just curious: is there maybe a way to tell mod_lookup_identity to just map every single attribute? This mainly because we do not update the apache config on already deployed instances, so if we can avoid having to ask people to change it if we add more fields, that would be useful.

I understand that this means we'd have things like REMOTE_USER_LOCALITY and REMOTE_USER_ST and need to map those in the code, but I think that that beats the alternative of having to ask users to update their apache config every time we add more attributes.

On the patch itself: looks good to me. I will wait for merging on an answer to my last question.

There is no documented way to automatically add all attributes found.

Would it be an idea to add that upstream?

(Will merge the patch now for the time being)