anchor.diff:  
   * `app`: A sample user app that uses both `api` and `uaa`. `app` is a web app that requires single sign-on and access to the `api` service on behalf of users.
   
  -* `scim`: The <a href="http://www.simplecloud.info/">SCIM</a> user management module used by UAA.
  -
  -### <a id='uaa-server'></a>UAA Server ###
  -
  -The authentication service, `uaa`, is a Spring MVC web app. You can deploy it in Tomcat or your container of choice, or execute `./gradlew run` to run it directly from the `uaa` directory in the source tree. When run with Gradle, `uaa` listens on port `8080` and has URL `http://localhost:8080/uaa`.
  -
  -The UAA Server supports the APIs defined in the UAA-APIs document which include the following:
  -
  -* The OAuth2 `/authorize` and `/token` endpoints
  -
  -* A `/login_info` endpoint to allow querying for required login prompts
  -
  -* An `/introspect` endpoint to allow resource servers to obtain information about an access token submitted by an OAuth2 client
  -
  -* SCIM user provisioning endpoint
  -
  -* OpenID connect endpoints to support authentication `/userinfo` and `/check_id`
  -
  -Command line clients can perform authentication by submitting credentials directly to the `/authorize` endpoint.
  +* `scim`: The System for Cross-domain Identity Management (SCIM) user management module used by UAA. For more information about SCIM, see the [System for Cross-domain Identity Management](http://www.simplecloud.info/) website.
  +
  +### <a id='uaa-server'></a> UAA Server
  +
  +The authentication service, `uaa`, is a Spring MVC web app. You can deploy it in Tomcat or your container of choice, or execute `./gradlew run` to run it directly from the `uaa` directory in the source tree. When run with Gradle, `uaa` listens on port 8080 and has the URL `http://localhost:8080/uaa`.
  +
  +The UAA server supports the APIs defined in the UAA-APIs document which include:
  +
  +* The OAuth2 `/authorize` and `/token` endpoints.
  +
  +* A `/login_info` endpoint to allow querying for required login prompts.
  +
  +* An `/introspect` endpoint to allow resource servers to obtain information about an access token submitted by an OAuth2 client.
  +
  +* A SCIM user-provisioning endpoint.
  +
  +* OpenID Connect endpoints `/userinfo` and `/check_id` to support authentication.
  +
  +Command-line clients can perform authentication by submitting credentials directly to the `/authorize` endpoint.
   
   An `ImplicitAccessTokenProvider` exists in Spring Security OAuth to use if your client is Java.
   
  -By default, `uaa` will launch with a context root `/uaa`.
  -
  -#### <a id='configuration'></a>Configuration ####
  +By default, `uaa` launches with a context root `/uaa`.
  +
  +#### <a id='configuration'></a> Configuration
   
   A `uaa.yml` file exists in the app. This file provides defaults to the placeholders in the Spring XML.
   
  -You can override any occurrences of `${placeholder.name}` in the XML by adding it to the `uaa.yml` file, or by providing a System property, `-D` to JVM, with the same name. 
  -
  -All passwords and client secrets in the config files are in plain text, but are inserted into the UAA database encrypted with BCrypt.
  -
  -#### <a id='user-account-data'></a>User Account Data ####
  -
  -The default uses an in-memory RDBMS user store, pre-populated with a single test user `marissa` with password `koala`.
  -
  -To use PostgreSQL for user data, activate the Spring profile `postgresql`.
  -
  -You can configure the active profiles in `uaa.yml` using the following:
  -
  -```yaml
  -spring_profiles: postgresql,default
  -```
  -
  -To use PostgreSQL instead of HyperSQL (hsqldb):
  -
  -<pre class="terminal">
  -$ echo "spring_profiles: postgresql,default" > src/main/resources/uaa.yml
  -$ ./gradlew run
  -</pre>
  -
  -To bootstrap a microcloud-type environment, you need an admin client. A database initializer component that inserts an admin client exists.
  -If the default profile is active, for example not `postgresql`, a cf CLI client exists so that the Gem login works with no additional configuration required. You can override the default settings and add additional clients in the `uaa.yml` file:
  -
  -```yaml
  +You can override any occurrences of `${placeholder.name}` in the XML by adding it to your `uaa.yml` file, or by providing a System property with the same name, `-D`, to your Java virtual machine. 
  +
  +All passwords and client secrets in the configuration files are in plain text, but are inserted into the UAA database encrypted with BCrypt.
  +
  +#### <a id='user-account-data'></a> User Account Data
  +
  +The default uses an in-memory relational database management system (RDBMS) user store, pre-populated with a single test user `marissa` with the password `koala`.
  +
  +To use PostgreSQL for user data, you must activate the Spring profile `postgresql`.
  +
  +You can configure the active profiles in your `uaa.yml` file using `spring_profiles: postgresql,default`.
  +
  +To use PostgreSQL instead of HyperSQL, run:
  +
  +```
  +echo "spring_profiles: postgresql,default" > src/main/resources/uaa.yml
  +./gradlew run
  +```
  +
  +To bootstrap a microcloud-type environment, you need an admin client. During the bootstrapping process, the database creates a database initializer component that inserts an admin client.
  +
  +If the default profile is active, the bootstrapping process creates a cf CLI client so that the Gem login works with no additional configuration required. You can override the default settings and add additional clients in the `uaa.yml` file, as in the example below:
  +
  +```
   oauth:
     clients:
       admin:
  
positive.code:     }
      </pre>
  
  3. Run `gem install cf-uaac` to install the <%= vars.product_short %> UAA Command Line Client (UAAC) Ruby gem.
  
      <pre class="terminal">
      $ gem install cf-uaac
      </pre>
  
  3. Run `uaac target http://localhost:8080/uaa` to target the local UAA server endpoint.
  
      <pre class="terminal">
      $ uaac target http://localhost:8080/uaa
      </pre>
  
  3. Run `uaac token client get CLIENT_NAME -s CLIENT_SECRET` to obtain an access token. Replace `CLIENT_NAME` and `CLIENT_SECRET` with actual values. For example, when starting up the UAA locally for development there should be a predefined [admin client](https://github.com/cloudfoundry/uaa/blob/a776ac3f2e6bf86e247097dc00df93c05a239c6e/uaa/src/main/webapp/WEB-INF/spring/oauth-clients.xml#L54) you can use:
  
      <pre class="terminal">
      $ uaac token client get admin -s adminsecret
      </pre>
  
      If you do not specify the client secret, UAAC will show an interactive prompt where you must enter the client secret value.
      
      The `uaac token client get` command requests an access token from the server using the OAuth2 [client credentials](https://tools.ietf.org/html/rfc6749#section-1.3.4) grant type.
      
  4. View your UAAC token context. When UAAC obtains a token, the token and other metadata is stored in the `~/.uaac.yml` file on your local machine. To view the token you have obtained, use the command `uaac context`. For example:
  
      <pre class="terminal">
      $ uaac context
  
negative.code: 
  Profile names can be hyphenated to indicate multiple contexts. For example, `local-vcap` can be used when the login server is in a different location than the UAA server.
  
  To see all apps, run:
  
  ```
  GET /app/apps
  ```
  
  The browser is redirected through a series of authentication and access grant steps.
  
  To see the currently logged-in user details and a selection of attributes from the OpenID provider, run:
  
  ```
  GET /app
  ```
  
  #### <a id='login-application'></a> Login App
  
  The `login` app is a user interface for authentication. UAA can also authenticate user accounts, but only if it manages them itself and it only provides a basic UI. You can brand and customize the login app for non-native authentication and for more complicated UI flows, like user registration and password reset.
  
  The login app is itself an OAuth2 endpoint provider, but delegates those features to the UAA server. Therefore, configuration for the login app consists of locating the UAA through its OAuth2 endpoint URLs and registering the login app itself as a client of the UAA. The UAA locations have a `login.yml`, such as the example below for a local `vcap` instance:
  
  ```
  uaa:
    url: http://uaa.vcap.example.net
    token:
  