Configure Apache for the OIDC-Connect PHP example

Use this sanitized SetEnv profile after completing the personal OAuth application registration. Copy it into the deployment's HTTPS virtual host, or include it from that virtual host. Do not serve the configuration file from the document root.

Every application-specific setting remains an angle-bracketed placeholder. The template contains no client ID, secret, fingerprint, envelope key, deployment hostname, port, or machine path.

# Sanitized Apache deployment profile for the OIDC-Connect PHP example.
#
# Replace every <PLACEHOLDER> before enabling the site; the SDK rejects
# placeholders. Keep the deployed file owner-readable only when it contains
# real secrets:
#
#   chmod 600 <SERVER_CONFIG_FILE>
#
# Register this exact callback after substituting the public origin:
#
#   <HTTPS_ORIGIN>/oidc-connect/m7_sso_session/callback
#
# HTTPS_ORIGIN is scheme + host + optional non-default port, with no path or
# trailing slash. DOCUMENT_ROOT is the deployment's Apache document root.

<Directory "<DOCUMENT_ROOT>/oidc-connect">
    Options -Indexes +FollowSymLinks
    AllowOverride All
    Require all granted

    # Browser-visible deployment coordinates. These are not credentials.
    SetEnv M7_PUBLIC_ORIGIN "<HTTPS_ORIGIN>"
    SetEnv M7_PUBLIC_HOME "<HTTPS_ORIGIN>/oidc-connect/"
    SetEnv M7_SSO_BASE_PATH "/oidc-connect/m7_sso_session"
    SetEnv M7_PENDING_COOKIE_PATH "/oidc-connect/m7_sso_session"
    SetEnv M7_COOKIE_DOMAIN "host_only"

    # M7_CLIENT_ID and M7_CLIENT_NAME come from the personal OAuth application
    # registration. M7_CLIENT_SECRET is shown only when it is created or
    # rotated; retrieve it from server-side secret storage, never from browser
    # code or a tracked configuration template.
    SetEnv M7_CLIENT_ID "<M7_CLIENT_ID_FROM_REGISTRATION>"
    SetEnv M7_CLIENT_NAME "<APPLICATION_NAME_FROM_REGISTRATION>"
    SetEnv M7_TOKEN_ENDPOINT_AUTH_METHOD "client_secret_basic"
    SetEnv M7_CLIENT_SECRET "<M7_CLIENT_SECRET_FROM_SECRET_STORAGE>"

    # M7 consumer-provider endpoints. Confirm current values through the M7
    # OpenID Provider discovery document before deploying.
    SetEnv M7_OIDC_ISSUER "https://sso.user.m7.org"
    SetEnv M7_AUTH_ENDPOINT "https://sso.user.m7.org/authorize"
    SetEnv M7_PAR_ENDPOINT "https://sso.user.m7.org/par"
    SetEnv M7_TOKEN_ENDPOINT "https://sso.user.m7.org/token"
    SetEnv M7_ACK_RELAY_ENDPOINT "https://sso.user.m7.org/token/ack"
    SetEnv M7_ACK_IDENTITY_ENDPOINT "https://id.m7.org/api/v2/oauth/token/ack"
    SetEnv M7_INTROSPECTION_ENDPOINT "https://sso.user.m7.org/introspect"
    SetEnv M7_USERINFO_ENDPOINT "https://sso.user.m7.org/userinfo"
    SetEnv M7_END_SESSION_ENDPOINT "https://sso.user.m7.org/end-session"
    SetEnv M7_REVOCATION_ENDPOINT "https://sso.user.m7.org/revoke"

    # Run `openssl rand -hex 32` to generate the current continuity value and
    # register/use that exact 64-character hexadecimal value. With no planned
    # rotation, M7_NEW_FINGERPRINT equals M7_FINGERPRINT. For a planned
    # rotation, run the command again to generate an independent successor.
    SetEnv M7_FINGERPRINT "<CURRENT_32_BYTE_FINGERPRINT_HEX>"
    SetEnv M7_NEW_FINGERPRINT "<CURRENT_OR_SUCCESSOR_32_BYTE_FINGERPRINT_HEX>"

    # Run `openssl rand -hex 32` separately to generate this local encryption
    # key. Do not reuse the OAuth client secret, current fingerprint, or
    # successor fingerprint. This value protects pending ACK state locally.
    SetEnv M7_PENDING_ENVELOPE_KEY "<INDEPENDENT_32_BYTE_ENVELOPE_KEY_HEX>"

    # These values agree with the registration card. PAR keeps the complete
    # authorization request out of the browser-facing redirect URL.
    SetEnv M7_AUTH_USE_PAR "true"
    SetEnv M7_SCOPE "openid profile email offline_access"
    SetEnv M7_TOKEN_REFRESH_MODE "ack_supersede_pending"

    # Return every local outcome to the example page. M7_REDIRECT_URI is
    # derived as <M7_PUBLIC_ORIGIN><M7_SSO_BASE_PATH>/callback.
    SetEnv M7_CALLBACK_PROCESS_SUCCESS "/oidc-connect/"
    SetEnv M7_CALLBACK_HOME "/oidc-connect/"
    SetEnv M7_CANCEL_URL "/oidc-connect/"
    SetEnv M7_LOGOUT_URI "<HTTPS_ORIGIN>/oidc-connect/"

    # Keep diagnostics off normally. Enable them temporarily only on an
    # access-controlled test deployment.
    SetEnv M7_WEB_SDK_DEBUG "off"
</Directory>

Generate the fingerprint and pending-envelope values independently. They have different trust roles even though each is 32 random bytes. The fingerprint is part of the registered continuity and refresh-binding contract; the envelope key remains local and encrypts pending token-acknowledgement state.

After replacing the placeholders, keep the completed file outside the public tree, restrict its permissions, test the Apache configuration, and reload the web worker. The OIDC-Connect purpose and layout guide explains why every local route is nested under /oidc-connect/m7_sso_session/.