anchor.diff:        kind: HTPasswdPasswordIdentityProvider
         file: /path/to/users.htpasswd <4>
   ----
  -<1> This provider name is prefixed to provider usernames to form an identity name.
  -<2> When `true`, unauthenticated token requests from non-web clients (like the
  +<1> This provider name is prefixed to provider user names to form an identity
  +name.
  +<2> When *true*, unauthenticated token requests from non-web clients (like the
   CLI) are sent a `WWW-Authenticate` challenge header for this provider.
  -<3> When `true`, unauthenticated token requests from web clients (like the web
  +<3> When *true*, unauthenticated token requests from web clients (like the web
   console) are redirected to a login page backed by this provider.
   <4> File generated using
   http://httpd.apache.org/docs/2.4/programs/htpasswd.html[`htpasswd`].
  
positive.code: A custom certificate bundle, extra scopes, extra authorization request
  parameters, and `*userInfo*` URL can also be specified:
  
  .Full Master Configuration Using `*OpenIDIdentityProvider*`
  ====
  
  ----
  
negative.code: 
  === OpenID Connect
  
  Set *OpenIDIdentityProvider* in the `*identityProviders*` stanza to integrate
  with an OpenID Connect identity provider using an
  link:http://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth[Authorization
  Code Flow].
  
  [NOTE]
  ====
  *ID Token* and *UserInfo* decryptions are not supported.
  ====
  
  By default, the *openid* scope is requested. If required, extra scopes can be
  specified in the `*extraScopes*` field.
  
  Claims are read from the JWT `id_token` returned from the OpenID identity
  