anchor.diff:  
   ## <a id='external-group'></a>Grant Admin Permissions to an External Group (SAML or LDAP) ##
   
  -To grant all users under an external group admin permissions:
  +Follow the steps below to grant all users under an external group admin permissions:
   
   1. Obtain the credentials of an admin client created using UAAC as above, or
   refer to the `uaa: scim` section of your deployment manifest for the user
   name and password of an admin user.
   
  -1. Use `uaac token client get admin -s ADMIN-CLIENT-SECRET` to authenticate and
  -obtain an access token for the admin client from the UAA server.
  +1. Run `uaac token client get admin -s ADMIN-CLIENT-PASSWORD` to authenticate and obtain an access token for the admin client from the UAA server. Replace 
  +`ADMIN-CLIENT-PASSWORD` with your admin password.
   UAAC stores the token in `~/.uaac.yml`.
       <pre class="terminal">
       $ uaac token client get admin -s MyAdminPassword
       </pre>
   
  -1. Run the following commands to grant all users under the mapped LDAP Group admin permissions:
  +1. Run the commands below to grant all users under the mapped LDAP Group admin permissions. Replace `GROUP-DISTINGUISHED-NAME` with an appropriate group name. 
       * `uaac group map --name scim.read "GROUP-DISTINGUISHED-NAME"`
       * `uaac group map --name cloud_controller.admin "GROUP-DISTINGUISHED-NAME"`
   
   1. <%= vars.saml_provider %>
   
  -1. Run the following commands to grant all users under the mapped SAML group admin permissions:
  +1. Run the commands below to grant all users under the mapped SAML group admin permissions. Replace `GROUP-NAME` with the group name, and `SAML-PROVIDER-NAME` with the name of your SAML provider.
       * `uaac group map --name scim.read "GROUP-NAME" --origin SAML-PROVIDER-NAME`
       * `uaac group map --name cloud_controller.admin "GROUP-NAME" --origin SAML-PROVIDER-NAME`
   
  
positive.code:     $ uaac token client get admin
      </pre>
  
  1. Use `uaac user add NEW-ADMIN-USERNAME -p NEW-ADMIN-PASSWORD --emails NEW-ADMIN-EMAIL` to create an admin user.
      <pre class="terminal">
      $ uaac user add Adam -p newAdminSecretPassword --emails newadmin<span>@</span>example.com
      </pre>
  
  1. Use `uaac member add GROUP NEW-ADMIN-USERNAME` to add the
  new admin to the groups `cloud_controller.admin`, `uaa.admin`, `scim.read`, `scim.write`.
      <pre class="terminal">
      $ uaac member add cloud_controller.admin Adam
      $ uaac member add uaa.admin Adam
  
negative.code: server for user information.
  
  1. If the admin user lacks permissions to query the UAA server for user
  information, add the permissions by following these steps:
      * Run `uaac client update admin --authorities "EXISTING-PERMISSIONS
      scim.write"` to add the necessary permissions to the admin user account on
      the UAA server. Replace EXISTING-PERMISSIONS with the current contents of
      the `scope` section from `uaac contexts`.
      * Run `uaac token delete` to delete the local token.
      * Run `uaac token client get admin` to obtain an updated access token from
      the UAA server.
  
      <pre class="terminal">
  