anchor.diff:        - X-Remote-User
   ----
   
  -Now restart everything:
  +*Final steps*
   
   ----
   # systemctl restart httpd
  
positive.code: 
    SSLProxyEngine on
    SSLProxyCACertificateFile /etc/pki/CA/certs/ca.crt
    SSLProxyMachineCertificateFile /etc/pki/tls/certs/authproxy.pem
  
    # Needed for efficient log watching
    SetEnv proxy-sendchunked 1
  
    # The value here will be important to tune for your performance needs.  At
    # some point Apache has to clean up stale connections.  The proxy is unable
    # to differenciate stale connections with say 'oc log -f' on a pod that
    # simply isn't outputing anything.  There are likely many other ProxyPass
    # settings that will need to be adjusted for Production workloads.
    ProxyTimeout 60
  
    # Insert your backend server name/ip here.
    ProxyPass / https://ose3-master.example.com:8443/
    ProxyPassReverse / https://ose3-master.example.com:8443/
  
    # Requests should be able to access /oauth/token/request and
    # /oauth/token/display without authentication.  In the case of
    # /outh/token/display OpenShift will check one of the
    # ORIGIN_AUTH_REQUEST_HANDLERS to see if the request is authenticated.
    # Technically it would require authentication for /oauth/token/display simply
    # by modifying these two ProxyMatch stanzas.
    <ProxyMatch /oauth/token/.*>
      Allow from all
    </ProxyMatch>
  
    # /oauth/authorize and /oauth/approve should be protected by Apache.
    <ProxyMatch /oauth/a.*>
      AuthUserFile /etc/openshift/htpasswd
      AuthType basic
  
      # For ldap:
      # AuthBasicProvider ldap
      # AuthLDAPURL "ldap://ldap.example.com:389/ou=People,dc=my-domain,dc=com?uid?sub?(objectClass=*)"
  
      # For Kerberos remove "AuthType basic" and insert the following:
      # AuthType Kerberos
      # KrbMethodNegotiate on
      # KrbMethodK5Passwd off
      # KrbServiceName Any
      # KrbAuthRealms EXAMPLE.COM
      # Krb5Keytab /path/to/keytab
      # KrbSaveCredentials off
  
      AuthName openshift
      Require valid-user
      RequestHeader set X-Remote-User %{REMOTE_USER}s
    </ProxyMatch>
  
    # All other requests should use Bearer tokens.  These can only be verified by
    # OpenShift so we need to let these requests pass through.
    <Proxy *>
      SetEnvIfNoCase Authorization Bearer passthrough
      Allow from env=passthrough
  
      Order Deny,Allow
      Deny from all
      Satisfy any
    </Proxy>
  </VirtualHost>
  
  RequestHeader unset X-Remote-User
  ----
  
  At this point, you can create the users in the system Apache is using to store
  accounts information. In this example, file-backed authentication is used:
  
negative.code: 
  .Apache Authentication Using *RequestHeaderIdentityProvider*
  ====
  This example configures an authentication proxy on the same host as the Master.
  Having the proxy and Master on the same host is merely a convenience and may
  not be suitable for your environment. For example, if you were already running
  a link:../admin_guide/install/deploy_router.html[Router] on the Master port 443
  would not be available.
  
  It’s also important to note that while this reference configuration uses
  Apache's mod_auth_form it is by no means required and other proxies can easily
  be used if the following requirements are met:
  
  1. Block the X-Remote-User header from client requests to prevent spoofing.
  2. Enfore client certificate authentication in the
  RequestHeaderIdentityProvider configuration
  3. Require the X-Csrf-Token header be set for all authentication request using the challenge flow.
  4. Only the /oauth/authorize endpoint should be proxied and redirects should not be rewritten to allow the backend server to send the client to the correct location.
  
  *Install the prerequisites*
  
  `mod_auth_form` is shipped as part of the `mod_session` package that is found
  in the https://access.redhat.com/solutions/392003[Optional channel]:
  
  ----
  # yum install -y httpd mod_ssl mod_session apr-util-openssl
  ----
  
  Generate a CA for validating requests that submit the trusted header. This CA
  