Luke Meyer of Red Hat reports:

Description of problem: The remote-user auth plugin provides an httpd config file intended to require authentication before setting the REMOTEUSER env var which is passed on to the plugin. However there are passthrough provisions for other forms of auth; in particular, the management console is allowed to set the X-Remote-User header on a request and have that transmuted to the REMOTEUSER env var (by virtue of being a non-proxied local request). When the REMOTEUSER env var is set, the remote-user plugin automatically trusts it. By combining the X-Remote-User header with one of the other passthrough triggers, any user can be impersonated without authenticating at all.

Additional info: Simple workaround: add this in the host httpd conf global config, e.g. at the end of /etc/httpd/conf.d/000002openshiftoriginbrokerproxy.conf:

RequestHeader unset X-Remote-User