anchor.diff:  +
   The custom web application will then need to also handle the response, which will include a `redirect`
   parameter with a URL in the IdP that contains the SAML Logout response. The application should redirect the user
  -there to complete the logout. 
  +there to complete the logout.
  
positive.code: The Elastic Stack supports the SAML 2.0 _Web Browser SSO_ and the SAML
  2.0 _Single Logout_ profiles and can integrate with any Identity Provider (IdP)
  that supports at least the SAML 2.0 _Web Browser SSO Profile_.
  It has been tested with a number of popular IdP implementations.
  
  This guide assumes that you have an existing IdP and wish to add {kib} as a
  Service Provider.
  
negative.code: - `metadata`: See <<saml-user-metadata>>
  
  For more information, see <<mapping-roles>> and
  <<security-role-mapping-apis>>.
  
  If your IdP has the ability to provide groups or roles to Service Providers,
  then you should map this SAML attribute to the `attributes.groups` setting in
  