anchor.diff:          email: <6>
           - custom_email_claim
           - email
  -      issuer:
  -        authorize: https://myidp.example.com/oauth2/authorize
  -        token: https://myidp.example.com/oauth2/token
  -        userInfo: https://myidp.example.com/oauth2/userinfo <7>
  +      issuer: https://www.idp-issuer.com
   
   ----
   <1> Optional: Reference to an {product-title} ConfigMap containing the
  
positive.code: <5> List of claims to use as the identity. First non-empty claim is used. At
  least one claim is required. If none of the listed claims have a value,
  authentication fails. For example, this uses the value of the `sub` claim in the returned `id_token` as the user's identity.
  <6> link:http://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint[Authorization Endpoint]
  described in the OpenID spec. Must use `https`.
  <7> link:http://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint[Token Endpoint]
  described in the OpenID spec. Must use `https`.
  
  .Full OpenID Connect CR
  
  
negative.code: parameters, or a `userInfo` URL, use the full OpenID Connect CR.
  
  .Standard OpenID Connect CR
  [source,yaml]
  ----
  apiVersion: config.openshift.io/v1
  