anchor.diff:  application]. The application must be configured with a callback URL of
   `<master>/oauth2callback/<identityProviderName>`.
   <6> The client secret issued by GitHub. This value may also be provided in an
  -link:../install_config/master_node_configuration.html#passwords[environment 
  +link:../install_config/master_node_configuration.html#passwords[environment
   variable, external file, or encrypted file].
  -<7> Optional list of organizations. If specified, only GitHub users that are members of 
  +<7> Optional list of organizations. If specified, only GitHub users that are members of
   at least one of the listed organizations will be allowed to log in. If the GitHub OAuth
  -application configured in *clientID* is not owned by the organization, an organization 
  -owner must grant third-party access in order to use this option. This can be done during 
  -the first GitHub login by the organization admin, or from the GitHub organization settings.
  +application configured in *clientID* is not owned by the organization, an organization
  +owner must grant third-party access in order to use this option. This can be done during
  +the first GitHub login by the organization's administrator, or from the GitHub organization settings.
   ====
   
   [[GitLab]]
  
positive.code: ====
  Using GitHub as an identity provider allows any GitHub user to authenticate to your server.
  You can limit authentication to members of specific GitHub organizations with the
  `organizations` config attribute, as shown below.
  ====
  
  .Master Configuration Using *GitHubIdentityProvider*
  
negative.code: must be presented and validated against the certificate authorities in the
  specified file before the request headers are checked for user names.
  <8> Header names to check, in order, for the user identity. The first header containing
  a value is used as the identity. Required, case-insensitive.
  <9> Header names to check, in order, for an email address. The first header containing
  a value is used as the email address. Optional, case-insensitive.
  <10> Header names to check, in order, for a display name. The first header containing
  