oracle apex HTTP头变量的Nginx kerberos身份验证

我们在apex的kerberos身份验证方案中获得了“HTTP头变量”。

f?p=&APP_ID.:LOGIN_DESKTOP:&APP_SESSION.:APEX_AUTHENTICATION=DB

在使用apache的代理服务器上,配置为:

<Location /ords>
  AuthType Kerberos
  AuthName "Kerberos Login"
  KrbAuthRealms smth
  KrbServiceName HTTP/devgate.smth@SMTH
  Krb5KeyTab /etc/krb-keytab/keytab.spnego
  require valid-user
  RewriteEngine On
  RewriteCond %{REMOTE_USER} (.+)@.*
  RewriteRule . - [E=RU:%1]
  RequestHeader set SSO_USER %{RU}e
</Location>
ProxyPass /ords/ http://site.smth:8888/ords/
ProxyPassReverse /ords/ http://site.smth:8888/ords/

我正试图迁移到另一台装有nginx的服务器上,但这个配置不起作用。

location /ords {
auth_gss on;
auth_gss_realm SMTH;
auth_gss_keytab /etc/krb-keytab/keytab.spnego;
auth_gss_service_name HTTP/devgate.smth;
proxy_set_header Origin "" ;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header SSO_USER $remote_user;
auth_gss_format_full on;
proxy_pass http://site.smth:8888/ords/;
     }

我做错了什么?