anchor.diff:  
   [NOTE]
   ====
  -xref:../architecture/additional_concepts/authorization.adoc#roles[Roles] need
  +link:../architecture/additional_concepts/authorization.html#roles[Roles] need
   to be assigned to administer the setup with an external user.
   ====
   
  
positive.code: <2> When *true*, unauthenticated token requests from non-web clients (like
  the CLI) are sent a `WWW-Authenticate` challenge header for this provider.
  This uses the http://doc.gitlab.com/ce/api/oauth2.html#resource-owner-password-credentials[Resource Owner Password Credentials]
  grant flow to obtain an access token from GitLab. 
  <2> *GitLabIdentityProvider* cannot be used to send `WWW-Authenticate`
  challenges.
  <3> When *true*, unauthenticated token requests from web clients (like the web
  
negative.code: <7> Optional: PEM-encoded certificate bundle. If set, a valid client certificate
  must be presented and validated against the certificate authorities in the
  specified file before the request headers are checked for user names.
  <8> Optional: list of common names (`cn`). If set, a valid client certificate with
  a Common Name (`cn`) in the specified list must be presented before the request headers
  are checked for user names. If empty, any Common Name is allowed. Can only be used in combination
  with `clientCA`.
  <9> Header names to check, in order, for the user identity. The first header containing
  a value is used as the identity. Required, case-insensitive.
  <10> Header names to check, in order, for an email address. The first header containing
  