anchor.diff:  |azure|TCP|AZURE_PING
   |===
   
  -For the cloud vendor specific stacks to work, you have to provide additional dependencies to Keycloak. You can find more information, including Links to repositories providing the additional dependencies, in the https://infinispan.org/docs/dev/titles/embedding/embedding.html#jgroups-cloud-discovery-protocols_cluster-transport[official Infinispan documentation].
  +Cloud vendor specific stacks have additional dependencies for Keycloak.
  +For more information and links to repositories with these dependencies, see the https://infinispan.org/docs/dev/titles/embedding/embedding.html#jgroups-cloud-discovery-protocols_cluster-transport[Infinispan documentation].
   
  -To provide the dependencies to Keycloak, put the respective JAR in the `providers` directory and `build` Keycloak afterwards, using
  +To provide the dependencies to Keycloak, put the respective JAR in the `providers` directory and `build` Keycloak by entering this command:
   
   <@kc.build parameters="--cache-stack=<ec2|google|azure>"/>
   
   === Securing cache communication
  -The current Infinispan cache implementation should be secured by various security measures such as RBAC, ACLs and Transport stack encryption. Please refer to the https://infinispan.org/docs/dev/titles/security/security.html#[Infinispan security guide] for more information about securing cache communication.
  +The current Infinispan cache implementation should be secured by various security measures such as RBAC, ACLs, and Transport stack encryption. For more information about securing cache communication, see the https://infinispan.org/docs/dev/titles/security/security.html#[Infinispan security guide].
   
   </@tmpl.guide>
  
positive.code: * keys
  
  .Invalidation of local caches
  Local caching improves performance, but adds a challenge in multi-node setups: When one Keycloak node updates data in the shared database, all other nodes need to be aware of it, so they invalidate that data from their caches. The `work` cache is used for sending these invalidation messages.
  
  .Authentication sessions
  Authentication sessions are started when an unauthenticated user or service tries to login to Keycloak. The `authenticationSessions` distributed cache is used to save data during authentication of particular user.
  
  .User sessions
  There are four distributed caches for sessions of authenticated users and services:
  
  * sessions
  * clientSessions
  * offlineSessions
  * offlineClientSessions
  
  These caches are used to save data about user sessions, and clients attached to the sessions.
  
  .Password brute force detection
  The `loginFailures` distributed cache is used to track data about failed login attempts. This cache is needed for the Brute Force Protection feature to work correctly in a multi-node Keycloak setup.
  
  .Action tokens
  Action tokens are used for scenarios when a user needs to confirm an action asynchronously, for example in the emails sent by the forgot password flow. The `actionTokens` distributed cache is used to track metadata about action tokens.
  
  The following table gives an overview of the specific caches Keycloak uses. These caches are configured in `conf/cache-ispn.xml`:
  
  |====
  |Cache name|Cache Type|Description
  
negative.code: summary="Understand how to configure the caching layer"
  includedOptions="cache cache-*">
  
  Keycloak is designed for high availability and multi-node clustered setups.
  The current distributed cache implementation is built on top of https://infinispan.org[Infinispan], a high-performance, distributable in-memory data grid.
  
  All available cache options are build options, so they need to be applied to a `build` of Keycloak before starting.
  
  == Enable distributed caching
  When you start Keycloak in production mode, by using the `start` command, caching is enabled and all Keycloak nodes in your network are discovered.
  
  To explicitly enable distributed infinispan caching, enter this command:
  
  <@kc.build parameters="--cache=ispn"/>
  
  When you start Keycloak in development mode, by using the `start-dev` command, Keycloak uses only local caches, applying the `--cache=local` option.
  The `local` cache mode is intended only for development and testing purposes.
  
  == Configuring caches
  Keycloak provides a cache configuration file with sensible defaults located at `conf/cache-ispn.xml`.
  
  The cache configuration is a regular https://infinispan.org/docs/stable/titles/configuring/configuring.html[Infinispan configuration file].
  
  === Cache types and defaults
  
  .Local caches
  Keycloak caches persistent data locally to avoid unnecessary database requests.
  The following caches are used:
  
  * realms
  * users
  