Enable the error pages on the global administrator tenant
Follow up after code review
Merge pull request #92 from bp323/issue-3321

Enable the error pages on the global administrator tenant
Changes to nginx config after widgetization of the Admin UI
Bump release environment 6.1.2 RC
Fix ERB placeholders for admin nginx config
Merge branch 'issue-3708' of https://github.com/bp323/puppet-hilary into issue-3708
Follow up on admin UI addditions
Bump release environment to 6.2 RC
Fixed tenant admin UI bug
Bump release environment to 6.2.0
Bump staging and performance to 6.2.0
Shibboleth

Adds support for running a Shibboleth Service Provider.

Configurations happens through hiera by configuring:
 * `shibboleth_entity_id`        -   The entity ID of our SP (e.g.: https://sp.oaeproject.org/shibboleth)
 * `shibboleth_keyname`          -   The name of our key (e.g.: `web0`)
 * `shibboleth_subjectname`      -   The subject name of our key (e.g.: `CN=web0`)
 * `shibboleth_hosts`            -   A hash of hashes, each inner hash containing the `hostname` where it's running and the attribute that should be used for the `remote_user` variable

The certificate and key should be copied to `./modules/shibboleth/templates/sp-cert.pem` and `./modules/shibboleth/templates/sp-key.pem`. (Note: **NOT** `modules/shibboleth/files`, this is due to puppet limitations)

Supporting Shib authentication is done by installing the Shibboleth SP software and running an apache with mod_shib.

When a user wants to authenticate with Shibboleth the following auth flow takes place:
1. The user browse to /api/auth/shibboleth
2. He is redirected to /Shibboleth.sso/Login?entityID=https://id.of.idp&return=https://hostname.of.tenant/api/auth/shibboleth/callback
3. This request is proxied by nginx to apache at localhost:8080 (and preserves the host header)
4. The request is passed on to mod_shib which starts the Shibboleth authentication flow and will redirect the user towards the IdP
5. When the user authenticates with the IdP, he will return to /Shibboleth.sso/SAML2/POST where the request is validated.
   This is again proxied to apache and mod_shib
6. If the request is valid, mod_shib will initiate a session and set a cookie for that user.
   Finally, the user is redirect /api/auth/shibboleth/callback.
7. This is again proxied to apache and mod_shib, where the cookie is checked against the sessionstore. If it's a valid session cookie, apache will proxy the
   request to the appserver (/api/auth/shibboleth/callback) and add the necessary headers in the request.
   These headers can be used by the OAE app server to getOrCreate a user account.

The Shibboleth metadata is also generated by this puppet work and is served by Nginx.
It's available at the typical endpoint at /Shibboleth.sso/Metadata.
Usually, it's the Shibboleth SP that outputs this metadata, but the data it outputs
does not work well in a multi-tenant environment.

There are 2 new modules included that are required to support this work:
 * puppetlabs/apache
 * puppetlabs/concat (The apache module requires it)
Apache proxies back to nginx for shib authentication
Add `underscores_in_headers` to the nginx config

This allows for passing the `remote_user` header from shib to the app
servers