anchor.diff:  ## <a name='restrictions'></a>Restrictions ##
   
    * UAA clients are scoped to services.  There must be a `dashboard_client` entry for each service that uses SSO integration.
  - * Each `dashboard_client id` must be unique across the CloudFoundry deployment.
  + * Each `dashboard_client id` must be unique across the <%= vars.platform_name %> deployment.
   
   ## <a name="resources"></a>Resources ##
   
  
positive.code: 
  ## <a name='introduction'></a>Introduction ##
  
  Single Sign-On (SSO) enables <%= vars.product_name %> users to authenticate with third-party service dashboards using their <%= vars.product_name %> credentials. Service dashboards are web interfaces which enable users to interact with some or all of the features the service offers. SSO provides a streamlined experience for users, limiting repeated logins and multiple accounts across their managed services. The user's credentials are never directly transmitted to the service since the OAuth protocol handles authentication.
  
  <% if vars.platform_code == 'CF'  %>
  Dashboard SSO was introduced in [cf-release v169](https://github.com/cloudfoundry/cf-release/tree/v169) so this or a newer version is required to support the feature.
  
negative.code: 
  ### <a name='oauth2-flow'></a>OAuth Flow ###
  
  When a user navigates to the URL from `dashboard_url`, the service dashboard should initiate the OAuth login flow. A summary of the flow can be found in [section 1.2 of the OAuth RFC](http://tools.ietf.org/html/rfc6749#section-1.2). OAuth expects the presence of an [Authorization Endpoint](http://tools.ietf.org/html/rfc6749#section-3.1) and a [Token Endpoint](http://tools.ietf.org/html/rfc6749#section-3.2). In <%= vars.platform_name %>, these endpoints are provided by the UAA. Clients can discover the location of UAA from Cloud Controller's info endpoint; in the response the location can be found in the `token_endpoint` field.
  
  ```
  $ curl api.example.com/info
  