anchor.diff:      }
       </pre>
   
  -3. Log in with the UAA Ruby gem:
  +3. Run `gem install cf-uaac` to install the Cloud Foundry UAA Command Line Client (UAAC) Ruby gem.
   
       <pre class="terminal">
       $ gem install cf-uaac
  +    </pre>
  +
  +3. Run `uaac target http://localhost:8080/uaa` to target the local UAA Server endpoint.
  +
  +    <pre class="terminal">
       $ uaac target http://localhost:8080/uaa
  + </pre>
  +
  +3. Run `uaac token get USERNAME PASSWORD` to log in. Replace `USERNAME` with your user name, and `PASSWORD` with your password. For example:
  +
  +    <pre class="terminal">
       $ uaac token get marissa koala
       </pre>
   
  -    If you do not specify username and password, you will be prompted to supply
  -    them.
  -
  -    This authenticates and obtains an access token from the server using the
  -    OAuth2 implicit grant, similar to the approach intended for a standalone
  -    client like the `cf` CLI.
  -    The token is stored in `~/.uaac.yml`.
  -    Open `~/.uaac.yml` to obtain the access token for your `cf` target, or use
  -    `--verbose` on the login command line above to see it in the command shell.
  -
  -4. Log in as a resource server and retrieve the token details:
  -
  -    <pre class="terminal">
  -    $ uaac target http://localhost:8080/uaa
  -    $ uaac token decode [token-value-from-above]
  -    </pre>
  -
  -    You should see your username and the client id of the original token grant
  -    on STDOUT:
  -
  -    ~~~
  -      jti: e3a7d065-8514-43c2-b1f8-f8ab761791e2
  -      sub: f796d1a2-eca3-4079-a317-f3224f8f7832
  -      scope: scim.userids password.write openid cloud_controller.write cloud_controller.read
  -      client_id: cf
  -      cid: cf
  -      user_id: f796d1a2-eca3-4079-a317-f3224f8f7832
  -      user_name: marissa
  -      email: marissa@example.org
  -      iat: 1413495264
  -      exp: 1413538464
  -      iss: http://localhost:8080/uaa/oauth/token
  -      aud: scim openid cloud_controller password
  -    ~~~
  -
  -### <a id='demo-hosted'></a>Remote Command Line Usage ###
  -
  -The command line example in the previous section should work against the UAA, although token encoding is unnecessary as you will not have the client secret.
  -
  -In this case, there is no need to run a local UAA server.
  -Query the external login endpoint about the system:
  -
  -<pre class="terminal">
  -$ curl -H "Accept: application/json" uaa.run.pivotal.io/login
  -{
  -  "timestamp":"2014-09-15T18:25:04+0000",
  -  "app":{"version":"1.8.3"},
  -  "commit_id":"git-metadata-not-found",
  -  "prompts":{"username":["text","Email"],
  -             "password":["password","Password"]
  -  }
  -}
  -</pre>
  -
  -You can then try logging in with the UAA Ruby gem. Make sure you have Ruby 1.9, then:
  -
  -<pre class="terminal">
  -$ gem install cf-uaac   # If you have not already installed cf-uaac
  -$ uaac target uaa.run.pivotal.io
  -$ uaac token get [yourusername] [yourpassword]
  -</pre>
  -
  -If you do not specify a username and password, you will be prompted to supply them.
  -
  -This authenticates and obtains an access token from the server using the OAuth2 implicit grant, which is the same grant that a client like the `cf` CLI uses.
  +    If you do not specify a username and password, the UAAC prompts you to 
  +    supply them.
  +    <br><br>
  +    The `uaac token client get` command authenticates and obtains an access 
  +    token from the server using the OAuth2 implicit grant, similar to the 
  +    approach intended for a standalone client like the Cloud Foundry Command 
  +    Line Interface (cf CLI). 
  +    <br><br>
  +    UAAC stores the access token in the `~/.uaac.yml` file. Open the 
  +    `~/.uaac.yml` in a text editor and copy this access token to use in the 
  +    next step.
  +
  +4. Run `uaac token decode ACCESS-TOKEN-VALUE` to retrieve the token details. Replace `ACCESS-TOKEN-VALUE` with your access token, copied from your `~/.uaac.yml` file. The UAAC should display your username and the client id of the original token grant. For example:
  +
  +    <pre class="terminal">
  +    $ uaac token decode abcdef0123456789ABCDEF0123456789ghijklmnopqr01234567890
  +    jti: e3a7d065-8514-43c2-b1f8-f8ab761791e2
  +    sub: f796d1a2-eca3-4079-a317-f3224f8f7832
  +    scope: scim.userids password.write openid cloud_controller.write cloud_controller.read
  +    client_id: cf
  +    cid: cf
  +    user_id: f796d1a2-eca3-4079-a317-f3224f8f7832
  +    user_name: marissa
  +    email: marissa@example.org
  +    iat: 1413495264
  +    exp: 1413538464
  +    iss: http://localhost:8080/uaa/oauth/token
  +    aud: scim openid cloud_controller password
  +    </pre>
  +
  +### <a id='cf'></a>Deploy UAA to Cloud Foundry ###
  +
  +Follow the instructions below to build the UAA as an app and push it to Cloud Foundry using the Cloud Foundry Command Line Interface (cf CLI). 
  +
  +1. In a terminal window, clone the UAA GitHub repository. 
  +
  +    <pre class="terminal">
  +    $ git clone git://github.com/cloudfoundry/uaa.git
  +    </pre>
  +
  +2. Navigate to the directory where you cloned the UAA GitHub repository, then run the `./gradlew :cloudfoundry-identity-uaa:war` command build the UAA as a WAR file. 
  +
  +    <pre class="terminal">
  +    $ cd uaa
  +    $ ./gradlew :cloudfoundry-identity-uaa:war
  +    </pre>
  +
  +3. Run the cf CLI `cf push APP-NAME -m 512M -p PATH-TO-WAR-FILE --no-start` command to push the app to Cloud Foundry. Replace `APP-NAME` with a name for your UAA app, and `PATH-TO-WAR-FILE` with the path to the WAR file you created in the previous step. For example:
  +
  +    <pre class="terminal">
  +    $ cf push MYUAA -m 512M -p uaa/build/libs/cloudfoundry-identity-uaa-1.8.0.war --no-start
  +    </pre>
  +
  +4. Run `cf set-env APP-NAME SPRING_PROFILES_ACTIVE default` to set the `SPRING_PROFILES_ACTIVE` environment variable with the value `default`. Replace `APP-NAME` with the name of your app that you used in the previous step. For example:
  +
  +    <pre class="terminal">
  +    $ cf set-env MYUAA SPRING_PROFILES_ACTIVE default
  +    </pre>
  +
  +5. Run `cf start APP-NAME` to start your app. Replace `APP-NAME` with the name of your app. For example:
  +
  +    <pre class="terminal">
  +    $ cf start MYUAA
  +    </pre>
  +
  +### <a id='demo-hosted'></a>Use Remote UAA ###
  +
  +You use a UAA server that you pushed as an app to Cloud Foundry in a similar way to one you [run locally](#demo-local). You do not need app token encoding because you do not have the client secret.
  +
  +Follow the steps below to access and use a UAA server that you pushed as an app to Cloud Foundry.
  +
  +
  +1. [Deploy UAA to Cloud Foundry](#) as described above. 
  +
  +1. From the project base directory, run `curl -H "Accept: application/json" APP-FQDN/login` to query the external login endpoint about the system. Replace `APP-FQDN` with the FQDN of your app. For example:
  +
  +    <pre class="terminal">
  +    $ curl -H "Accept: application/json" uaa.example.org/login
  +    {
  +      "timestamp":"2014-09-15T18:25:04+0000",
  +      "app":{"version":"1.8.3"},
  +      "commit_id":"git-metadata-not-found",
  +      "prompts":{"username":["text","Email"],
  +          "password":["password","Password"]
  +      }
  +    }
  +    </pre>
  +
  +1. Run `gem install cf-uaac` to install the Cloud Foundry UAA Command Line Client (UAAC) Ruby gem.
  +
  +    <pre class="terminal">
  +    $ gem install cf-uaac
  +    </pre>
  +
  +3. Run `uaac target APP-FQDN` to target the remote UAA Server endpoint. Replace `APP-FQDN` with the FQDN of your app.
  +    <pre class="terminal">
  +    $ uaac target uaa.example.org
  +    </pre>
  +
  +3. Run `uaac token get USERNAME PASSWORD` to log in. Replace `USERNAME` with your user name, and `PASSWORD` with your password. For example:
  +
  +    <pre class="terminal">
  +    $ uaac token get marissa koala
  +    </pre>
  +
  +    If you do not specify a username and password, the UAAC prompts you to 
  +    supply them.
  +    <br><br>
  +    The `uaac token client get` command authenticates and obtains an access 
  +    token from the server using the OAuth2 implicit grant, similar to the 
  +    approach intended for a standalone client like the Cloud Foundry Command 
  +    Line Interface (cf CLI). 
   
   ## <a id='integration'></a>Integration Tests ##
   
  
positive.code: $ ./gradlew integrationTest
  </pre>
  
  This starts a UAA server running in a local Apache Tomcat instance. By default, the service URL is set to `http://localhost:8080/uaa`.
  
  You can set the environment variable `CLOUD_FOUNDRY_CONFIG_PATH` to a directory containing a `uaa.yml` file in which the various URLs used in the tests are changed, and the UAA server context root may be set.
  
  ### <a id='custom-configuration'></a>Custom YAML Configuration ###
  
  To modify the runtime parameters you can provide a `uaa.yml`, as shown in the following example:
  
  <pre class="terminal">
  $ cat > /tmp/uaa.yml
  uaa:
    host: uaa.appcloud21.dev.mozycloud
    test:
      username: dev@cloudfoundry.org # defaults to vcap_tester@vmware.com
      password: changeme
      email: dev@cloudfoundry.org
  </pre>
  
  Then from `uaa/uaa`:
  
  <pre class="terminal">
      $ CLOUD_FOUNDRY_CONFIG_PATH=/tmp ./gradlew test
  </pre>
  
  The webapp looks for a YAML file in the following locations
  (later entries override earlier ones) when it starts up.
  
  ```yaml
      classpath:uaa.yml
      file:${CLOUD_FOUNDRY_CONFIG_PATH}/uaa.yml
      file:${UAA_CONFIG_FILE}
      ${UAA_CONFIG_URL}
  ```
  
  ###<a id='gradle-test'></a>Test with PostgreSQL or MySQL ###
  
  The default UAA unit tests (`./gradlew test`) use hsqldb.
  
  To run the unit tests using PostgreSQL:
  
  <pre class="terminal">
  $ echo "spring_profiles: default,postgresql" > src/main/resources/uaa.yml
  $ ./gradlew test integrationTest
  </pre>
  
  To run the unit tests using MySQL:
  
  <pre class="terminal">
  $ echo "spring_profiles: default,mysql" > src/main/resources/uaa.yml
  $ ./gradlew test integrationTest
  </pre>
  
  The database configuration for the common and scim modules is located at `common/src/test/resources/(mysql|postgresql).properties` and `scim/src/test/resources/(mysql|postgresql).properties`.
  
  ## <a id='projects'></a>UAA Projects ##
  
  There are several projects: the main `uaa` server application, and some samples:
  
  * `common` is a module containing a JAR with all the business logic. It is used in the webapps below.
  
  * `uaa` is the UAA server. `uaa` provides an authentication service plus authorized delegation for back-end services and apps by issuing OAuth2 access tokens.
  
  * `api` (sample) is an OAuth2 resource service which returns a mock list of deployed apps. `api` is a service that provides resources that other applications might want to access on behalf of the resource owner.
  
  * `app` (sample) is a user application that uses both of the above. `app` is a webapp that needs single sign-on and access to the `api` service on behalf of users.
  
  * `scim` is the <a href="http://www.simplecloud.info/">SCIM</a> user management module used by UAA.
  
  ### <a id='uaa-server'></a>UAA Server ###
  
  The authentication service is `uaa`. It is a plain Spring MVC webapp.
  Deploy as normal in Tomcat or your container of choice, or execute `./gradlew run` to run it directly from the `uaa` directory in the source tree. When running with Gradle, it listens on port 8080 and the URL is `http://localhost:8080/uaa`.
  
  The UAA Server supports the APIs defined in the UAA-APIs document. To summarize:
  
  1. The OAuth2 `/authorize` and `/token` endpoints
  
  2. A `/login_info` endpoint to allow querying for required login prompts
  
  3. A `/check_token` endpoint, to allow resource servers to obtain information about an access token submitted by an OAuth2 client.
  
  4. SCIM user provisioning endpoint
  
  5. OpenID connect endpoints to support authentication `/userinfo` and `/check_id` (todo). Implemented roughly enough to get it working (so `/app` authenticates here), but not to meet the spec.
  
  Command line clients can perform authentication by submitting credentials directly to the `/authorize` endpoint.
  There is an `ImplicitAccessTokenProvider` in Spring Security OAuth that can do the heavy lifting if your client is Java.
  
  By default, `uaa` will launch with a context root `/uaa`.
  
  #### <a id='configuration'></a>Configuration ####
  
  There is a `uaa.yml` file in the application which provides defaults to the placeholders in the Spring XML.
  Wherever you see `${placeholder.name}` in the XML, there is an opportunity to override it either by providing a System property (`-D` to JVM) with the same name, or a custom `uaa.yml` (as described above).
  
  All passwords and client secrets in the config files are plain text, but they will be inserted into the UAA database encrypted with BCrypt.
  
  #### <a id='user-account-data'></a>User Account Data ####
  
  The default is to use an in-memory RDBMS user store that is pre-populated with a single test user: `marissa` with password `koala`.
  
  To use Postgresql for user data, activate the Spring profile `postgresql`.
  
  You can configure the active profiles in `uaa.yml` using:
  
  ```yaml
  spring_profiles: postgresql,default
  ```
  
  To use PostgreSQL instead of HSQL:
  
  <pre class="terminal">
  $ echo "spring_profiles: postgresql,default" > src/main/resources/uaa.yml
  $ ./gradlew run
  </pre>
  
  To bootstrap a microcloud-type environment, you need an admin client; there is a database initializer component that inserts one.
  If the default profile is active (i.e. not `postgresql`), there is also a `cf` CLI client so that the gem login works out of the box.
  You can override the default settings and add additional clients in `uaa.yml`:
  
  ```yaml
  oauth:
  
negative.code:     url: http://uaa.vcap.example.net/login.do
  ```
  
  An environment variable or Java System property also exists, `LOGIN_SECRET`, for the client secret that the app uses when it authenticates itself with the UAA.
  The login app is registered by default in the UAA only if there are no active Spring profiles.
  In the UAA, the registration is located in the `oauth-clients.xml` config file:
  
  