Skip to content

Sync configuration from other repos #608

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Fryguy merged 3 commits into from
Jul 21, 2026
Merged

Sync configuration from other repos #608

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9b856a7
Reorganize OIDC settings into logical groups
jrafanie Jun 29, 2026
a46a466
Pin OIDCCacheShmMax to 500 to avoid memory regression on Power
jrafanie Jun 29, 2026
c3e6e8c
Fix duplicate headers, Reporting-Endpoints hostname, and redundant HSTS
jrafanie Jul 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions external_auth/oidc-httpd-configs/application.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,16 @@ Options SymLinksIfOwnerMatch
ProxyPreserveHost on
RequestHeader set Host ${HTTPD_AUTH_HOST}:${HTTPD_AUTH_PORT}
RequestHeader set X-Forwarded-Host ${HTTPD_AUTH_HOST}:${HTTPD_AUTH_PORT}
Header always unset Strict-Transport-Security
Header always set Strict-Transport-Security "max-age=631138519"
Header always unset X-Content-Type-Options
Header always set X-Content-Type-Options "nosniff"
Header always unset Referrer-Policy
Header always set Referrer-Policy "no-referrer-when-downgrade"
Header always unset X-Frame-Options
Header always set X-Frame-Options "SAMEORIGIN"
Header always unset Reporting-Endpoints
Header always set Reporting-Endpoints "csp-endpoint=\"https://%{HTTP_HOST}i/dashboard/csp_report\""

RewriteCond %{REQUEST_URI} ^/ws/notifications [NC]
RewriteCond %{HTTP:UPGRADE} ^websocket$ [NC]
Expand Down
31 changes: 19 additions & 12 deletions external_auth/oidc-httpd-configs/authentication.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,38 +2,47 @@ LoadModule auth_openidc_module modules/mod_auth_openidc.so
ServerName http://${HTTPD_AUTH_HOST}:${HTTPD_AUTH_PORT}
LogLevel debug

OIDCProviderMetadataURL https://${HTTPD_AUTH_HOST}:8443/realms/ManageIQ/.well-known/openid-configuration
OIDCClientID ${HTTPD_AUTH_OIDC_CLIENT_ID}
OIDCClientSecret ${HTTPD_AUTH_OIDC_CLIENT_SECRET}
OIDCRedirectURI http://${HTTPD_AUTH_HOST}:${HTTPD_AUTH_PORT}/oidc_login/redirect_uri
OIDCCryptoPassphrase sp-secret
OIDCOAuthRemoteUserClaim username
OIDCCacheShmEntrySizeMax 65536

OIDCOAuthClientID ${HTTPD_AUTH_OIDC_CLIENT_ID}
OIDCOAuthClientSecret ${HTTPD_AUTH_OIDC_CLIENT_SECRET}

OIDCProviderMetadataURL https://${HTTPD_AUTH_HOST}:8443/realms/ManageIQ/.well-known/openid-configuration

OIDCOAuthIntrospectionEndpoint https://${HTTPD_AUTH_HOST}:8443/realms/ManageIQ/protocol/openid-connect/token/introspect
OIDCOAuthIntrospectionEndpointAuth client_secret_post

OIDCRedirectURI http://${HTTPD_AUTH_HOST}:${HTTPD_AUTH_PORT}/oidc_login/redirect_uri

OIDCOAuthRemoteUserClaim username
OIDCPassClaimsAs both none

OIDCCacheShmEntrySizeMax 65536
OIDCCacheShmMax 500

OIDCCookieSameSite On
OIDCCryptoPassphrase sp-secret

# different from production (hacks for self signed keys ssl)
OIDCSSLValidateServer Off
OIDCOAuthSSLValidateServer Off
# /different

OIDCPassClaimsAs both none

# Set HSTS globally
Header always unset Strict-Transport-Security
Header always set Strict-Transport-Security "max-age=631138519"
Header always unset X-Content-Type-Options
Header always set X-Content-Type-Options "nosniff"
Header always unset Referrer-Policy
Header always set Referrer-Policy "no-referrer-when-downgrade"
Header always unset Reporting-Endpoints
Header always set Reporting-Endpoints "csp-endpoint=\"https://%{HTTP_HOST}i/dashboard/csp_report\""

# CSP for OIDC authentication redirects - allows inline styles/scripts needed by auth flow
<Location /oidc_login>
AuthType openid-connect
Require valid-user
FileETag None
# Explicit HSTS for redundancy
Header always set Strict-Transport-Security "max-age=631138519"
Header always setifempty Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; report-uri /dashboard/csp_report; report-to csp-endpoint"
Header set Report-To "{\"group\":\"csp-endpoint\",\"max_age\":10886400,\"endpoints\":[{\"url\":\"/dashboard/csp_report\"}]}"
Header Set Cache-Control "max-age=0, no-store, no-cache, must-revalidate"
Expand All @@ -45,8 +54,6 @@ Header always set X-Content-Type-Options "nosniff"
AuthType openid-connect
Require valid-user
FileETag None
# Explicit HSTS for redundancy
Header always set Strict-Transport-Security "max-age=631138519"
Header always setifempty Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; report-uri /dashboard/csp_report; report-to csp-endpoint"
Header set Report-To "{\"group\":\"csp-endpoint\",\"max_age\":10886400,\"endpoints\":[{\"url\":\"/dashboard/csp_report\"}]}"
Header Set Cache-Control "max-age=0, no-store, no-cache, must-revalidate"
Expand Down