anchor.diff:  
   [NOTE]
   ====
  -xref:../architecture/additional_concepts/authorization.adoc#roles[Roles] need
  +link:../architecture/additional_concepts/authorization.html#roles[Roles] need
   to be assigned to administer the setup with an external user.
   ====
   
  
positive.code: <2> When *true*, unauthenticated token requests from non-web clients (like
  the CLI) are sent a `WWW-Authenticate` challenge header for this provider.
  This uses the http://doc.gitlab.com/ce/api/oauth2.html#resource-owner-password-credentials[Resource Owner Password Credentials]
  grant flow to obtain an access token from GitLab. 
  <2> *GitLabIdentityProvider* cannot be used to send `WWW-Authenticate`
  challenges.
  <3> When *true*, unauthenticated token requests from web clients (like the web
  
negative.code: identity name. It is also used to build the redirect URL.
  <2> When *true*, unauthenticated token requests from non-web clients (like
  the CLI) are sent a `WWW-Authenticate` challenge header for this provider.
  This requires the OpenID provider to support the
  https://tools.ietf.org/html/rfc6749#section-1.3.3[Resource Owner Password Credentials] grant flow.
  <2> *OpenIDIdentityProvider* cannot be used to send `WWW-Authenticate`
  challenges.
  