anchor.diff:      publicURL: https://ose3-master.example.com:443/console/
   ----
   
  -[[requestheader-master-ca-config]]The `*identityProviders*` stanza in the
  +[[requestheader-master-ca-config]]
  +The `*identityProviders*` stanza in the
   *_/etc/openshift/master/master-config.yaml_* file must be updated as well:
   
   ----
  
positive.code: ----
  <1> This provider name is prefixed to the user name in the request header to
  form an identity name.
  <2> *RequestHeaderIdentityProvider* can only respond to clients that request `WWW-Authenticate` challenges by redirecting to a configured `challengeURL`. The configured URL should respond with a `WWW-Authenticate` challenge.
  <3> *RequestHeaderIdentityProvider* can only respond to clients requesting a login flow by redirecting to a configured `loginURL`. The configured URL should respond with a login flow.
  <4> Optional: URL to redirect unauthenticated /oauth/authorize requests to, for clients which expect interactive logins. `${url}` is replaced with the current URL, escaped to be safe in a query parameter. `${query}` is replaced with the current query string.
  <5> Optional: URL to redirect unauthenticated /oauth/authorize requests to, for clients which expect WWW-Authenticate challenges. `${url}` is replaced with the current URL, escaped to be safe in a query parameter. `${query}` is replaced with the current query string.
  <6> Optional: PEM-encoded certificate bundle. If set, a valid client certificate
  must be presented and validated against the certificate authorities in the
  specified file before the request headers are checked for user names.
  
negative.code: 
  .Apache Authentication Using *RequestHeaderIdentityProvider*
  ====
  This example configures an authentication proxy on the same host as the master.
  Having the proxy and master on the same host is merely a convenience and may not
  be suitable for your environment. For example, if you were already
  link:../install_config/install/deploy_router.html[running a router] on the
  master, port 443 would not be available.
  
  It is also important to note that while this reference configuration uses
  Apache's *mod_auth_form*, it is by no means required and other proxies can
  easily be used if the following requirements are met:
  
  1. Block the `X-Remote-User` header from client requests to prevent spoofing.
  2. Enforce client certificate authentication in the
  *RequestHeaderIdentityProvider* configuration.
  3. Require the `X-Csrf-Token` header be set for all authentication request using
  the challenge flow.
  4. Only the _/oauth/authorize_ endpoint should be proxied, and redirects should
  not be rewritten to allow the backend server to send the client to the correct
  location.
  
  *Installing the Prerequisites*
  
  The *mod_auth_form* module is shipped as part of the *mod_session* package that
  is found in the https://access.redhat.com/solutions/392003[Optional channel]:
  
  ----
  # yum install -y httpd mod_ssl mod_session apr-util-openssl
  