Sync configuration from other repos#608
Merged
Fryguy merged 3 commits intoJul 21, 2026
Merged
Conversation
Group related OIDC settings together for better readability and maintainability. Settings are organized into functional categories: 1. Client credentials (OIDC + OAuth client ID/secret) 2. Provider endpoints (metadata URL) 3. OAuth introspection settings 4. Redirect/Response settings 5. Pass/Claim settings (how user info is passed) 6. Cache settings 7. Security settings (Cookie, Crypto) Related to ManageIQ/manageiq-appliance#408
mod_auth_openidc upgraded from: mod_auth_openidc-2.4.10-1.el9_6.2.ppc64le to: mod_auth_openidc-2.4.16.11-1.el9.ppc64le In v2.4.13, OIDC_DEFAULT_CACHE_SHM_SIZE changed from 500 to 2000: OpenIDC/mod_auth_openidc@dec66b7 OIDC_MINIMUM_CACHE_SHM_ENTRY_SIZE_MAX was also removed (previously: 8192+512+17). In v2.4.14, OIDC_DEFAULT_CACHE_SHM_SIZE changed again from 2000 to 10000: OpenIDC/mod_auth_openidc@5990854 On Power, the larger page size caused memory usage to jump from 70-80 MB to over 600 MB. This pins the value back to the prior 2.4.10 default. Adjusting per-platform values can be addressed separately. Related to ManageIQ/manageiq-pods#1320 Related to ManageIQ/manageiq-appliance#400
Apache `Header always set` appends to any value already set by the
proxied Rails response. Precede each with `Header always unset` to
clear the upstream value first so clients never receive a header twice.
Also fix `%{HTTP_HOST}e` -> `%{HTTP_HOST}i` on Reporting-Endpoints.
`HTTP_HOST` is a request header, not an Apache env var; `e` yields null
and the CSP report endpoint URL was broken as a result.
HSTS was also being duplicated inside the /oidc_login and
/ui/service/oidc_login Location blocks. Both are covered by the
server-global `Header always set Strict-Transport-Security` already set
above the Location blocks; remove the redundant copies and the
"Explicit HSTS for redundancy" comments along with them.
Bring application.conf up to parity by adding the missing
Referrer-Policy, X-Frame-Options, and Reporting-Endpoints headers at
the VirtualHost level.
Fixes CP4AIOPS-25657
Fixes CP4AIOPS-31150
Related to ManageIQ/manageiq-appliance#411
Related to ManageIQ/manageiq-appliance#412
Related to ManageIQ/manageiq-pods#1411
Related to ManageIQ/manageiq-pods#1412
Member
|
Checked commits jrafanie/guides@9b856a7~...c3e6e8c with ruby 3.3.10, rubocop 1.86.0, haml-lint 0.73.0, and yamllint 1.37.1 |
github-actions Bot
pushed a commit
to ManageIQ/manageiq.github.io
that referenced
this pull request
Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix duplicate headers, Reporting-Endpoints hostname, and redundant HSTS
Related to ManageIQ/manageiq-appliance#411
Related to ManageIQ/manageiq-appliance#412
Related to ManageIQ/manageiq-pods#1411
Related to ManageIQ/manageiq-pods#1412
Pin OIDCCacheShmMax to 500 to avoid memory regression on Power
Related to ManageIQ/manageiq-pods#1320
Related to ManageIQ/manageiq-appliance#400
Reorganize OIDC settings into logical groups
Related to ManageIQ/manageiq-appliance#408