anchor.diff:  
   ## <a name='introduction'></a>Introduction ##
   
  -Single Sign-On (SSO) enables <%= vars.product_name %> users to authenticate with third-party service dashboards using their <%= vars.product_name %> credentials. Service dashboards are web interfaces which enable users to interact with some or all of the features the service offers. SSO provides a streamlined experience for users, limiting repeated logins and multiple accounts across their managed services. The user's credentials are never directly transmitted to the service since the OAuth protocol handles authentication.
  +Single Sign-On (SSO) enables <%= vars.platform_name %> users to authenticate with third-party service dashboards using their <%= vars.platform_name %> credentials. Service dashboards are web interfaces which enable users to interact with some or all of the features the service offers. SSO provides a streamlined experience for users, limiting repeated logins and multiple accounts across their managed services. The user's credentials are never directly transmitted to the service since the OAuth protocol handles authentication.
   
   <% if vars.platform_code == 'CF'  %>
   Dashboard SSO was introduced in [cf-release v169](https://github.com/cloudfoundry/cf-release/tree/v169) so this or a newer version is required to support the feature.
  
positive.code:       }
        ```
      The `dashboard_client` field is a hash containing three fields:
      - `id` is the unique identifier for the OAuth client that will be created for your service dashboard on the token server (UAA), and will be used by your dashboard to authenticate with the token server (UAA). If the client id is already taken, <%= vars.product_name %> will return an error when registering or updating the broker.
      - `secret` is the shared secret your dashboard will use to authenticate with the token server (UAA).
      - `redirect_uri` is used by the token server as an additional security precaution. UAA will not provide a token if the callback URL declared by the service dashboard doesn't match the domain name in `redirect_uri`. The token server matches on the domain name, so any paths will also match; e.g. a service dashboard requesting a token and declaring a callback URL of `http://p-mysql.example.com/manage/auth` would be approved if `redirect_uri` for its client is `http://p-mysql.example.com/`.
  
  
negative.code: "allow_debug":true}
  ```
  
  <p class='note'>To enable service dashboards to support SSO for service instances created from different <%= vars.platform_name %> instances, the /v2/info url is sent to service brokers in the <code>X-Api-Info-Location</code> header of every API call. A service dashboard should be able to discover this URL from the broker, and enabling the dashboard to contact the appropriate UAA for a particular service instance.</p>
  
  A service dashboard should implement the OAuth Authorization Code Grant type ([UAA documentation](https://github.com/cloudfoundry/uaa/blob/master/docs/UAA-APIs.rst#authorization-code-grant), [RFC documentation](http://tools.ietf.org/html/rfc6749#section-4.1)).
  
  