anchor.diff:  openshift/kubernetes userbase, presumably using OAuth tokens supplied
   in the HTTP headers.
   
  -=== service broker/service catalogue
  +=== service broker api
   
   The service broker implementation is part of the address
   controller. This really just represents a slightly different API into
  
positive.code:   * used for no authentication option above
  2. keycloak instance with plugins
    * used for enmasse authentication option above
    * need to setup keycloak realm per address space with admin user
  
  TODO: Need to update the address model to include the necessary
  configuration details for the authentication service to use in the
  address space resource schema. This includes host and port, but may
  also be a CA cert for verifying the authentication services
  certificate.
  
  ....
  diff --git a/documentation/address-model/resource-definitions.md b/documentation/address-model/resource-definitions.md
  
negative.code: == scope
  
  There are various different interfaces for externally facing
  components that need to protected via authentication. There are also
  two types of userbase:
  
  1. there is the userbase for the openshift/kubernetes cluster that is
  controlled by the cluster administrators
  
  2. each address-space will have its own userbase that the owner of
  that address space can control
  
  === address controller api
  
  