anchor.diff:    ...
     identityProviders:
     - name: my_openid_connect <1>
  -    challenge: false <2>
  +    challenge: true <2>
       login: true <3>
       mappingMethod: claim <4>
       provider:
  
positive.code: ----
  <1> This provider name is prefixed to the GitLab numeric user ID to form an
  identity name. It is also used to build the callback URL.
  <2> *GitLabIdentityProvider* cannot be used to send `WWW-Authenticate`
  challenges.
  <3> When *true*, unauthenticated token requests from web clients (like the web
  
negative.code: ----
  <1> This provider name is prefixed to the value of the identity claim to form an
  identity name. It is also used to build the redirect URL.
  <2> When *true*, unauthenticated token requests from non-web clients (like
  the CLI) are sent a `WWW-Authenticate` challenge header for this provider.
  This requires the OpenID provider to support the 
  https://tools.ietf.org/html/rfc6749#section-1.3.3[Resource Owner Password Credentials] grant flow.
  <2> *OpenIDIdentityProvider* cannot be used to send `WWW-Authenticate`
  challenges.
  <3> When *true*, unauthenticated token requests from web clients (like the web
  