anchor.diff:  ----
   <1> This provider name is prefixed to the user name in the request header to
   form an identity name.
  -<2> *RequestHeaderIdentityProvider* can only respond to clients that request `WWW-Authenticate` challenges by redirecting to a configured `challengeURL`. The configured URL should respond with a `WWW-Authenticate` challenge.
  -<3> *RequestHeaderIdentityProvider* can only respond to clients requesting a login flow by redirecting to a configured `loginURL`. The configured URL should respond with a login flow.
  -<4> Optional: URL to redirect unauthenticated /oauth/authorize requests to, for clients which expect interactive logins. `${url}` is replaced with the current URL, escaped to be safe in a query parameter. `${query}` is replaced with the current query string.
  -<5> Optional: URL to redirect unauthenticated /oauth/authorize requests to, for clients which expect WWW-Authenticate challenges. `${url}` is replaced with the current URL, escaped to be safe in a query parameter. `${query}` is replaced with the current query string.
  +<2> *RequestHeaderIdentityProvider* can only respond to clients that request
  +`WWW-Authenticate` challenges by redirecting to a configured `challengeURL`. The
  +configured URL should respond with a `WWW-Authenticate` challenge.
  +<3> *RequestHeaderIdentityProvider* can only respond to clients requesting a
  +login flow by redirecting to a configured `loginURL`. The configured URL should
  +respond with a login flow.
  +<4> Optional: URL to redirect unauthenticated _/oauth/authorize_ requests to,
  +for clients which expect interactive logins. _${url}_ is replaced with the
  +current URL, escaped to be safe in a query parameter. _${query}_ is replaced
  +with the current query string.
  +<5> Optional: URL to redirect unauthenticated _/oauth/authorize_ requests to,
  +for clients which expect `WWW-Authenticate` challenges. _${url}_ is replaced
  +with the current URL, escaped to be safe in a query parameter. _${query}_ is
  +replaced with the current query string.
   <6> Optional: PEM-encoded certificate bundle. If set, a valid client certificate
   must be presented and validated against the certificate authorities in the
   specified file before the request headers are checked for user names.
  
positive.code: 
  .Apache Authentication Using *RequestHeaderIdentityProvider*
  ====
  This example configures an authentication proxy on the same host as the Master.
  Having the proxy and Master on the same host is merely a convenience and may
  not be suitable for your environment. For example, if you were already running
  a link:../admin_guide/install/deploy_router.html[Router] on the Master port 443
  would not be available.
  
  It’s also important to note that while this reference configuration uses
  Apache's mod_auth_form it is by no means required and other proxies can easily
  be used if the following requirements are met:
  
  1. Block the X-Remote-User header from client requests to prevent spoofing.
  2. Enfore client certificate authentication in the
  RequestHeaderIdentityProvider configuration
  3. Require the X-Csrf-Token header be set for all authentication request using the challenge flow.
  4. Only the /oauth/authorize endpoint should be proxied and redirects should not be rewritten to allow the backend server to send the client to the correct location.
  
  *Install the prerequisites*
  
  `mod_auth_form` is shipped as part of the `mod_session` package that is found
  in the https://access.redhat.com/solutions/392003[Optional channel]:
  
  ----
  # yum install -y httpd mod_ssl mod_session apr-util-openssl
  
negative.code: that is specified for `*SSLCertificateFile*`. If a new certificate needs to be
  created, the `oadm ca create-server-cert` command can be used.
  
  *Configuring Apache*
  
  Unlike OpenShift Enterprise 2, this proxy does not need to reside on the same
  host as the master. It uses a client certificate to connect to the master, which
  is configured to trust the `X-Remote-User` header.
  
  Configure Apache per the following:
  
  ----
  LoadModule auth_form_module modules/mod_auth_form.so
  