anchor.diff:  The proxy will contact the Cloud Controller as the user to determine if the
   policy allows the user to access application containers via SSH.
   
  -Client example:
  -<pre class='terminal'>
  -$ curl -k -v -H "Authorization: $(cf oauth-token | tail -1)" \
  -    https://uaa.bosh-lite.com/oauth/authorize \
  -    --data-urlencode  "client_id=$(cf curl /v2/info | jq -r .app_ssh_oauth_client)" \
  -    --data-urlencode 'response_type=code' 2>&1 | \
  -    grep Location: | \
  -    cut -f2 -d'?' | \
  -    cut -f2 -d'=' | \
  -    pbcopy # paste authorization code when prompted for password
  -</pre>
  -
  -The cf CLI can also be used for the SSH code.
  +You can use the cf CLI to obtain the SSH code.
   <pre class='terminal'>
   $ cf ssh-code | pbcopy # paste authorization code when prompted for password
   </pre>
  
positive.code: 
  <strong><%= modified_date %></strong>
  
  This page assumes you are using cf CLI v6.13.0 or later.
  
  This topic describes how to SSH into a Cloud Foundry deployed application instance. You can start an SSH session to an app instance from the CLI. You can also enable, disable, and check SSH permission for an app from the CLI. 
  
  ## <a id="ssh-commands"></a>cf CLI SSH Commands
  
  ### <a id="enable-disable-ssh"></a>Enabling and Disabling SSH Access to Apps
  The CLI supports enabling and disabling SSH access to applications. Run `cf enable` to allow SSH access to all instances of the app, or `cf disable` to disallow access.
  <pre class="terminal">
  $ cf enable MY-AWESOME-APP
  </pre>
  
  <pre class="terminal">
  $ cf disable MY-AWESOME-APP
  </pre>
  
  ### <a id="report-ssh-app-status"></a>Checking SSH Permission for Apps
  To check whether you can access an app with SSH, run `cf ssh-enabled`.
  
  <pre class="terminal">
  $ cf ssh-enabled MY-AWESOME-APP
  ssh support is disabled for 'MY-AWESOME-APP'
  </pre>
  
  ### <a id="ssh-command"></a>The SSH Command
  If your app is running on Diego with SSH enabled and your operator has configured SSH access to be publicly routable, run `cf ssh <APP-NAME>` in the terminal to start an interactive SSH session in instance index 0 of your app.
  <pre class='terminal'>
  $ cf ssh MY-AWESOME-APP
  </pre>
  
  To target a different instance index with `cf ssh`, supply it via the `-i` flag.
  
  The `cf ssh` command also supports executing commands inside the app instance and forwarding local ports to it via the `-L` flag.
  
  ### <a id="configure-ssh-access-spaces"></a> Enabling and Disabling SSH Access for Spaces
  In addition to configuring SSH access to applications, you can also enable and disable SSH access at the space level. 
  
  Allow SSH access for the space
  <pre class="terminal">
  $ cf allow-space-ssh SPACE-NAME
  </pre>
  
  Disallow SSH access for the space
  <pre class="terminal">
  $ cf disallow-space-ssh SPACE-NAME
  </pre>
  
  ### <a id="report-ssh-space-status"></a>Checking SSH Permission for Spaces
  You can check whether SSH access for the space is allowed
  <pre class="terminal">
  $ cf space-ssh-allowed SPACE-NAME
  </pre>
  
  ### <a id="ssh-auth-code"></a>Get SSH Code for Proxy Authentication
  This command can be used to obtain a one-time authorization code that can be used as an SSH password with either the cf CLI or another SSH client
  <pre class="terminal">
  $ cf ssh-code
  </pre>
  
  ## <a id="other-ssh-access"></a>SSH Access without cf CLI
  
  You can connect to your SSH-enabled app instance via other SSH clients provided that deployment allows SSH access at the platform, space and app level. The Cloud Controller `/v2/info` endpoint contains an `app_ssh_endpoint` field with the domain name and port for the externally available SSH endpoint, and an `app_ssh_host_key_fingerprint` field with the fingerprint of the host key for the deployment. 
  
  To connect to a particular instance of your app, run `ssh -p SSH-PORT cf:APP-GUID/APP-INSTANCE-INDEX@SSH-DOMAIN`.
  
  To transfer files with `scp`, run `ssh -P SSH-PORT -o User=cf:APP-GUID/APP-INSTANCE-INDEX SSH-DOMAIN:REMOTE-FILE-TO-RETRIEVE LOCAL-FILE-DESTINATION`
  
  ## <a id="proxy-authentication"></a>Diego SSH Proxy Authentication and Daemon Discovery
  
  
negative.code: 
  ### Authentication via Cloud Controller and UAA
  
  For authentication to <%=vars.product_full%>, the user is of the form `cf:APP-GUID/INSTANCE` and the
  password must be an authorization code that the SSH proxy server can exchange
  for an authorization token. The SSH proxy must be configured to use an OAuth
  client id that has been defined in the UAA. The client id used by the proxy
  