From 9b856a727b37f5a1c781f5a6dc12df4dd48ab551 Mon Sep 17 00:00:00 2001
From: Joe Rafaniello <jrafanie@gmail.com>
Date: Mon, 29 Jun 2026 13:25:24 -0400
Subject: [PATCH 1/3] Reorganize OIDC settings into logical groups

Group related OIDC settings together for better readability and
maintainability. Settings are organized into functional categories:

1. Client credentials (OIDC + OAuth client ID/secret)
2. Provider endpoints (metadata URL)
3. OAuth introspection settings
4. Redirect/Response settings
5. Pass/Claim settings (how user info is passed)
6. Cache settings
7. Security settings (Cookie, Crypto)

Related to https://github.com/ManageIQ/manageiq-appliance/pull/408
---
 .../oidc-httpd-configs/authentication.conf    | 20 +++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/external_auth/oidc-httpd-configs/authentication.conf b/external_auth/oidc-httpd-configs/authentication.conf
index 291db12..cff19f4 100644
--- a/external_auth/oidc-httpd-configs/authentication.conf
+++ b/external_auth/oidc-httpd-configs/authentication.conf
@@ -2,27 +2,31 @@ LoadModule auth_openidc_module modules/mod_auth_openidc.so
 ServerName http://${HTTPD_AUTH_HOST}:${HTTPD_AUTH_PORT}
 LogLevel   debug
 
-OIDCProviderMetadataURL            https://${HTTPD_AUTH_HOST}:8443/realms/ManageIQ/.well-known/openid-configuration
 OIDCClientID                       ${HTTPD_AUTH_OIDC_CLIENT_ID}
 OIDCClientSecret                   ${HTTPD_AUTH_OIDC_CLIENT_SECRET}
-OIDCRedirectURI                    http://${HTTPD_AUTH_HOST}:${HTTPD_AUTH_PORT}/oidc_login/redirect_uri
-OIDCCryptoPassphrase               sp-secret
-OIDCOAuthRemoteUserClaim           username
-OIDCCacheShmEntrySizeMax           65536
-
 OIDCOAuthClientID                  ${HTTPD_AUTH_OIDC_CLIENT_ID}
 OIDCOAuthClientSecret              ${HTTPD_AUTH_OIDC_CLIENT_SECRET}
+
+OIDCProviderMetadataURL            https://${HTTPD_AUTH_HOST}:8443/realms/ManageIQ/.well-known/openid-configuration
+
 OIDCOAuthIntrospectionEndpoint     https://${HTTPD_AUTH_HOST}:8443/realms/ManageIQ/protocol/openid-connect/token/introspect
 OIDCOAuthIntrospectionEndpointAuth client_secret_post
+
+OIDCRedirectURI                    http://${HTTPD_AUTH_HOST}:${HTTPD_AUTH_PORT}/oidc_login/redirect_uri
+
+OIDCOAuthRemoteUserClaim           username
+OIDCPassClaimsAs                   both none
+
+OIDCCacheShmEntrySizeMax           65536
+
 OIDCCookieSameSite                 On
+OIDCCryptoPassphrase               sp-secret
 
 # different from production (hacks for self signed keys ssl)
 OIDCSSLValidateServer              Off
 OIDCOAuthSSLValidateServer         Off
 # /different
 
-OIDCPassClaimsAs both none
-
 # Set HSTS globally
 Header always set Strict-Transport-Security "max-age=631138519"
 Header always set X-Content-Type-Options "nosniff"

From a46a466b6fbffec5ec4619a48ca5b500ef2fa611 Mon Sep 17 00:00:00 2001
From: Joe Rafaniello <jrafanie@gmail.com>
Date: Mon, 29 Jun 2026 13:25:59 -0400
Subject: [PATCH 2/3] Pin OIDCCacheShmMax to 500 to avoid memory regression on
 Power

mod_auth_openidc upgraded from:
  mod_auth_openidc-2.4.10-1.el9_6.2.ppc64le
to:
  mod_auth_openidc-2.4.16.11-1.el9.ppc64le

In v2.4.13, OIDC_DEFAULT_CACHE_SHM_SIZE changed from 500 to 2000:
  OpenIDC/mod_auth_openidc@dec66b7
OIDC_MINIMUM_CACHE_SHM_ENTRY_SIZE_MAX was also removed (previously: 8192+512+17).

In v2.4.14, OIDC_DEFAULT_CACHE_SHM_SIZE changed again from 2000 to 10000:
  OpenIDC/mod_auth_openidc@5990854

On Power, the larger page size caused memory usage to jump from 70-80 MB
to over 600 MB. This pins the value back to the prior 2.4.10 default.
Adjusting per-platform values can be addressed separately.

Related to https://github.com/ManageIQ/manageiq-pods/pull/1320
Related to https://github.com/ManageIQ/manageiq-appliance/pull/400
---
 external_auth/oidc-httpd-configs/authentication.conf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/external_auth/oidc-httpd-configs/authentication.conf b/external_auth/oidc-httpd-configs/authentication.conf
index cff19f4..905bd98 100644
--- a/external_auth/oidc-httpd-configs/authentication.conf
+++ b/external_auth/oidc-httpd-configs/authentication.conf
@@ -18,6 +18,7 @@ OIDCOAuthRemoteUserClaim           username
 OIDCPassClaimsAs                   both none
 
 OIDCCacheShmEntrySizeMax           65536
+OIDCCacheShmMax                    500
 
 OIDCCookieSameSite                 On
 OIDCCryptoPassphrase               sp-secret

From c3e6e8cc36af14bfe39fc8fe9caed4956eb68889 Mon Sep 17 00:00:00 2001
From: Joe Rafaniello <jrafanie@gmail.com>
Date: Tue, 21 Jul 2026 12:28:44 -0400
Subject: [PATCH 3/3] Fix duplicate headers, Reporting-Endpoints hostname, and
 redundant HSTS

Apache `Header always set` appends to any value already set by the
proxied Rails response. Precede each with `Header always unset` to
clear the upstream value first so clients never receive a header twice.

Also fix `%{HTTP_HOST}e` -> `%{HTTP_HOST}i` on Reporting-Endpoints.
`HTTP_HOST` is a request header, not an Apache env var; `e` yields null
and the CSP report endpoint URL was broken as a result.

HSTS was also being duplicated inside the /oidc_login and
/ui/service/oidc_login Location blocks. Both are covered by the
server-global `Header always set Strict-Transport-Security` already set
above the Location blocks; remove the redundant copies and the
"Explicit HSTS for redundancy" comments along with them.

Bring application.conf up to parity by adding the missing
Referrer-Policy, X-Frame-Options, and Reporting-Endpoints headers at
the VirtualHost level.

Fixes CP4AIOPS-25657
Fixes CP4AIOPS-31150

Related to https://github.com/ManageIQ/manageiq-appliance/pull/411
Related to https://github.com/ManageIQ/manageiq-appliance/pull/412
Related to https://github.com/ManageIQ/manageiq-pods/pull/1411
Related to https://github.com/ManageIQ/manageiq-pods/pull/1412
---
 external_auth/oidc-httpd-configs/application.conf    |  8 ++++++++
 external_auth/oidc-httpd-configs/authentication.conf | 10 ++++++----
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/external_auth/oidc-httpd-configs/application.conf b/external_auth/oidc-httpd-configs/application.conf
index 60f71e7..546b85f 100644
--- a/external_auth/oidc-httpd-configs/application.conf
+++ b/external_auth/oidc-httpd-configs/application.conf
@@ -13,8 +13,16 @@ Options SymLinksIfOwnerMatch
   ProxyPreserveHost on
   RequestHeader set Host ${HTTPD_AUTH_HOST}:${HTTPD_AUTH_PORT}
   RequestHeader set X-Forwarded-Host ${HTTPD_AUTH_HOST}:${HTTPD_AUTH_PORT}
+  Header always unset Strict-Transport-Security
   Header always set Strict-Transport-Security "max-age=631138519"
+  Header always unset X-Content-Type-Options
   Header always set X-Content-Type-Options "nosniff"
+  Header always unset Referrer-Policy
+  Header always set Referrer-Policy "no-referrer-when-downgrade"
+  Header always unset X-Frame-Options
+  Header always set X-Frame-Options "SAMEORIGIN"
+  Header always unset Reporting-Endpoints
+  Header always set Reporting-Endpoints "csp-endpoint=\"https://%{HTTP_HOST}i/dashboard/csp_report\""
 
   RewriteCond %{REQUEST_URI}     ^/ws/notifications [NC]
   RewriteCond %{HTTP:UPGRADE}    ^websocket$ [NC]
diff --git a/external_auth/oidc-httpd-configs/authentication.conf b/external_auth/oidc-httpd-configs/authentication.conf
index 905bd98..08d0057 100644
--- a/external_auth/oidc-httpd-configs/authentication.conf
+++ b/external_auth/oidc-httpd-configs/authentication.conf
@@ -29,16 +29,20 @@ OIDCOAuthSSLValidateServer         Off
 # /different
 
 # Set HSTS globally
+Header always unset Strict-Transport-Security
 Header always set Strict-Transport-Security "max-age=631138519"
+Header always unset X-Content-Type-Options
 Header always set X-Content-Type-Options "nosniff"
+Header always unset Referrer-Policy
+Header always set Referrer-Policy "no-referrer-when-downgrade"
+Header always unset Reporting-Endpoints
+Header always set Reporting-Endpoints "csp-endpoint=\"https://%{HTTP_HOST}i/dashboard/csp_report\""
 
 # CSP for OIDC authentication redirects - allows inline styles/scripts needed by auth flow
 <Location /oidc_login>
   AuthType                   openid-connect
   Require                    valid-user
   FileETag                   None
-  # Explicit HSTS for redundancy
-  Header always set Strict-Transport-Security "max-age=631138519"
   Header always setifempty Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; report-uri /dashboard/csp_report; report-to csp-endpoint"
   Header set Report-To       "{\"group\":\"csp-endpoint\",\"max_age\":10886400,\"endpoints\":[{\"url\":\"/dashboard/csp_report\"}]}"
   Header Set Cache-Control   "max-age=0, no-store, no-cache, must-revalidate"
@@ -50,8 +54,6 @@ Header always set X-Content-Type-Options "nosniff"
   AuthType                   openid-connect
   Require                    valid-user
   FileETag                   None
-  # Explicit HSTS for redundancy
-  Header always set Strict-Transport-Security "max-age=631138519"
   Header always setifempty Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; report-uri /dashboard/csp_report; report-to csp-endpoint"
   Header set Report-To       "{\"group\":\"csp-endpoint\",\"max_age\":10886400,\"endpoints\":[{\"url\":\"/dashboard/csp_report\"}]}"
   Header Set Cache-Control   "max-age=0, no-store, no-cache, must-revalidate"