anchor.diff:      apiman.es.username=es_admin
       apiman.es.password=es_admin_password
   
  -Obviously you will need to replace the values in the properties above with those appropriate for your 
  -installation of elasticsearch.
  +Obviously you will need to replace the values in the properties above with those appropriate for your
  +installation of Elasticsearch.
   
   
   :numbered!:
  
positive.code: The image above should give you an idea of how they all fit together.
  
  == Database
  You have a number of persistence options in both Keycloak and apiman, but this guide will focus on using an 
  RDBMS instead of other options (e.g. Elasticsearch for apiman or mongodb for KC).
  
  On a separate server, install a production ready database such as mysql, mariadb, or postresql.  You will 
  want to create two schemas/databases:
  
  * keycloak
  * apiman
  
  Make sure your DB is accessible remotely and enable whatever security options you need (SSL, users/passwords).  
  We recommend using two different users and permissioning them appropriately (e.g. create a "sa_apiman" account 
  and a "sa_keycloak" account).
  
  After creating the ‘apiman' database, you can initialize it using the appropriate DDL for the database you 
  selected.  We currently support mysql5/mariadb and postgresql.  The DDLs for these databases can be found in 
  the quickstart overlay ZIP file, or you can grab them directly from github.  For example:
  
  https://github.com/apiman/apiman/tree/master/distro/data/src/main/resources/ddls
  
  Make sure you grab the right one for whichever version of apiman you are going to be installing (*hint*: use 
  the appropriate github tag).
  
  
  == Elasticsearch
  If you wish to enable metrics in apiman (who doesn't?) you'll need to install Elasticsearch.  This is 
  because the API Gateway stores all metrics information in Elasticsearch (by default), and the API Manager 
  queries that data to present analytics information in the UI.
  
  Please see the Elasticsearch documentation for how to install and configure it in production.  Ultimately you 
  will need Elasticsearch running in a well known and accessible location.  We also recommend you enable 
  authentication (e.g. via Shield) and SSL.
  
  TIP: The data in Elasticsearch is not backed up or stored in some other location - Elasticsearch is being 
  used as the primary/canonical data store for the metrics information.  You may wish to configure backup 
  procedures 
  
  
  == Keycloak
  In production, it is typically useful to deploy Keycloak server as a standalone solution.  For more 
  specific information about how to configure a standalone Keycloak server, see the Keycloak documentation:  
  
  http://keycloak.github.io/docs/userguide/html/server-installation.html
  
  Once Keycloak is installed as a standalone server, you must configure the ‘apiman' realm.  This realm will 
  be used for authentication into each of the apiman components (API Manager REST services, API Manager UI, 
  API Gateway REST services, etc).
  
  TIP: You can configure additional Keycloak Realms for use when using the apiman "Keycloak OAuth2 Policy".
  
  Fortunately, apiman comes with a realm file you can import.  Simply log into your keycloak server and then 
  create the apiman realm using this file:
  
  https://github.com/apiman/apiman/blob/master/distro/data/src/main/resources/data/apiman-realm.json
  
  TIP: The realm file contains some credentials/secrets that you may want to modify.  The defaults are obviously not secure.
  
  Once you have created the apiman realm, you must use the keycloak UI to add your API Manager UI as a valid 
  redirect URL for the ‘apimanui' client.  To do this, log into the keycloak admin console and choose the 
  *apiman* realm.  Next click "clients" in the left navigation, and choose *apimanui* in the resulting list.  
  From there you can add public URL if your API Manager UI to the list of "*_Valid Redirect URIs_*".  It might 
  be something like:
  
      https://apimanager.mycompany.org:8443/apimanui/*
  
  That will allow users of the API Manager UI to actually log in and be properly redirected back to the 
  application!
  
  
  
negative.code: 
  You can find the apiman production deployer here:
  
  https://github.com/apiman/apiman-deployer/tree/1.2.1.Final
  
  Simply download that script and run it on each of the machines you wish to install the various apiman
  components!
  
  TIP: The production guide assumes you are installing into WildFly 9.  The instructions are slightly
  different if you are using EAP 6.4 or WildFly 8.  In particular, the Keycloak settings in standalone.xml
  are a bit different (because for our EAP6.4 and WF8 support we use an older version of KC).
  
  == Architecture Summary
  Before we get started, it may be useful to know the overall architecture of apiman.  Let's start with a
  picture!
  
  .Architecture of apiman
  