anchor.diff:  is configured to trust the `X-Remote-User` header.
   
   ----
  +LoadModule auth_form_module modules/mod_auth_form.so
  +LoadModule session_module modules/mod_session.so
  +LoadModule request_module modules/mod_request.so
  +
   # Nothing needs to be served over HTTP.  This virtual host simply redirects to
   # HTTPS.
   <VirtualHost *:80>
  
positive.code: 
    SSLProxyEngine on
    SSLProxyCACertificateFile /etc/pki/CA/certs/ca.crt
    SSLProxyMachineCertificateFile /etc/pki/tls/certs/authproxy.pem
  
    # Needed for efficient log watching
    SetEnv proxy-sendchunked 1
  
    # The value here will be important to tune for your performance needs.  At
    # some point Apache has to clean up stale connections.  The proxy is unable
    # to differenciate stale connections with say 'oc log -f' on a pod that
    # simply isn't outputing anything.  There are likely many other ProxyPass
    # settings that will need to be adjusted for Production workloads.
    ProxyTimeout 60
  
    # Insert your backend server name/ip here.
    ProxyPass / https://ose3-master.example.com:8443/
    ProxyPassReverse / https://ose3-master.example.com:8443/
  
    # Requests should be able to access /oauth/token/request and
    # /oauth/token/display without authentication.  In the case of
    # /outh/token/display OpenShift will check one of the
    # ORIGIN_AUTH_REQUEST_HANDLERS to see if the request is authenticated.
    # Technically it would require authentication for /oauth/token/display simply
    # by modifying these two ProxyMatch stanzas.
    <ProxyMatch /oauth/token/.*>
      Allow from all
    </ProxyMatch>
  
    # /oauth/authorize and /oauth/approve should be protected by Apache.
    <ProxyMatch /oauth/a.*>
      AuthUserFile /etc/openshift/htpasswd
      AuthType basic
  
      # For ldap:
      # AuthBasicProvider ldap
      # AuthLDAPURL "ldap://ldap.example.com:389/ou=People,dc=my-domain,dc=com?uid?sub?(objectClass=*)"
  
      # For Kerberos remove "AuthType basic" and insert the following:
      # AuthType Kerberos
      # KrbMethodNegotiate on
      # KrbMethodK5Passwd off
      # KrbServiceName Any
      # KrbAuthRealms EXAMPLE.COM
      # Krb5Keytab /path/to/keytab
      # KrbSaveCredentials off
  
      AuthName openshift
      Require valid-user
      RequestHeader set X-Remote-User %{REMOTE_USER}s
    </ProxyMatch>
  
    # All other requests should use Bearer tokens.  These can only be verified by
    # OpenShift so we need to let these requests pass through.
    <Proxy *>
      SetEnvIfNoCase Authorization Bearer passthrough
      Allow from env=passthrough
  
      Order Deny,Allow
      Deny from all
      Satisfy any
    </Proxy>
  </VirtualHost>
  
  RequestHeader unset X-Remote-User
  ----
  
  At this point, you can create the users in the system Apache is using to store
  accounts information. In this example, file-backed authentication is used:
  
negative.code: ----
    identityProviders:
    - name: requestheader
      challenge: true
      challengeURL: "https://[MASTER]/challenging-proxy/oauth/authorize?${query}"
      login: true
      loginURL: "https://[MASTER]/login-proxy/oauth/authorize?${query}"
      provider:
        apiVersion: v1
        kind: RequestHeaderIdentityProvider
  