How to use OIDCUnAuthAction pass in mod_auth_openidc correctly?

Question

I want to use mod_auth_openidc for authentication only, by using what is set in REMOTE_USER.

Currently, I have this:

<Location />
  # reverse proxy to app
  # authorization not controlled by web server, but by app
  Require all granted
</Location>

The user accesses an url hosted by the app that logs them in. When logged in, there's additional info on every page, and access is allowed to some urls that otherwise return 401.

Now I want to add OIDC to this, so I tried adding the following:

OIDCRedirectURI https://<hostname>/oidc/redirect_uri
<Location /oidc>
    ProxyPass "!"
    AuthType openid-connect
    Require valid-user
</Location>

Accessing "/oidc" successfully redirects to the provider, then redirects back to /oidc, which doesn't exist in the app, so apache goes 404.

If I go anywhere else, no REMOTE_USER is set and so the user is not authenticated. (I have a debug-page that dumps headers and environment variables and other sundry for this.)

I found this question: Optional or anonymous authentication with mod_auth_openidc, which mentions OIDCUnAuthAction, but it is unclear how to use it.

If I change the first location-block to:

<Location />
  # reverse proxy to app
  # authorization not controlled by web server, but by app
  Require all granted
  OIDCUnAuthAction pass
</Location>

.. then the user is no longer redirected.

If I in addition add OIDCUnAuthAction auth to the second Location-block, the redirect is back and the user is back to being redirected to /oidc and not being authenticated anywhere else.

<Location /oidc>
    ProxyPass "!"
    AuthType openid-connect
    Require valid-user
    OIDCUnAuthAction auth
</Location>

If I keep the last version of the /oidc-block and change the first block to

<Location />
  # reverse proxy to app
  # authorization not controlled by web server, but by app
  AuthType openid-connect
  Require valid-user
  OIDCUnAuthAction pass
</Location>

.. that doesn't change anything.

If I do force login everywhere, with

<Location />
  # reverse proxy to app
  # authorization not controlled by web server, but by app
  AuthType openid-connect
  Require valid-user
</Location>

then accessing any page redirects me to the provider, which redirects me to where I came from. On the debug-page I see that there are lots of claims headers, but REMOTE_USER is either not set, or set in such a way that it cannot be dumped (it's not visible to the app), so the user is not authenticated.

If I use OIDCAuthNHeader Foo it turns up together with the other http headers, prefixed with HTTP_, but then the app can't find it since it isn't named REMOTE_USER...

I'm at my wits end. How is this supposed to work? Can it work at all?