anchor.diff:          <class>org.apache.nifi.registry.security.authorization.file.FileAccessPolicyProvider</class>
           <property name="User Group Provider">composite-user-group-provider</property>
           <property name="Authorizations File">./conf/authorizations.xml</property>
  -        <property name="Initial Admin Identity">John Smith</property>
  +        <property name="Initial Admin Identity">User 1/property>
           <property name="NiFi Identity 1">cn=nifi-node1,ou=servers,dc=example,dc=com</property>
           <property name="NiFi Identity 2">cn=nifi-node2,ou=servers,dc=example,dc=com</property>
       </accessPolicyProvider>
  
positive.code: * Configurable User Group Provider - A configurable user group provider.
  * User Group Provider - The identifier of user group providers to load from. The name of each property must be unique, for example: "User Group Provider A", "User Group Provider B", "User Group Provider C" or "User Group Provider 1", "User Group Provider 2", "User Group Provider 3"
  
  The default AccessPolicyProvider is the FileAccessPolicyProvider, however, you can develop additional AccessPolicyProvider as extensions.  The FileAccessPolicyProvider has the following properties:
  
  * User Group Provider - The identifier for an User Group Provider defined above that will be used to access users and groups for use in the managed access policies.
  * Authorizations File - The file where the FileAccessPolicyProvider will store policies.
  * Initial Admin Identity - The identity of an initial admin user that will be granted access to the UI and given the ability to create additional users, groups, and policies. The value of this property could be a DN when using certificates or LDAP, or a Kerberos principal. This property will only be used when there are no other policies defined. If this property is specified then a Legacy Authorized Users File can not be specified.
  * NiFi Identity - The identity of a NiFi instance/node that will be accessing this registry. Each NiFi Identity will be granted permission to proxy user requests, as well as read any bucket to perform status checks.
  
  The identities configured in the Initial Admin Identity and NiFi Identity properties must be available in the configured User Group Provider.
  
  The default authorizer is the StandardManagedAuthorizer, however, you can develop additional authorizers as extensions.  The StandardManagedAuthorizer has the following properties:
  
  * Access Policy Provider - The identifier for an Access Policy Provider defined above.
  
  The FileAuthorizer has been replaced with the more granular StandardManagedAuthorizer approach described above. However, it is still available for backwards compatibility reasons. The
  FileAuthorizer has the following properties.
  
  * Authorizations File - The file where the FileAuthorizer stores policies.  By default, the 'authorizations.xml' in the 'conf' directory is chosen.
  * Users File - The file where the FileAuthorizer stores users and groups.  By default, the 'users.xml' in the 'conf' directory is chosen.
  * Initial Admin Identity - The identity of an initial admin user that is granted access to the UI and given the ability to create additional users, groups, and policies. This property is only used when there are no other users, groups, and policies defined.
  * NiFi Identity - The identity of a NiFi instance/node that will be accessing this registry. Each NiFi Identity will be granted permission to proxy user requests, as well as read any bucket to perform status checks.
  
  [[initial-admin-identity]]
  Initial Admin Identity  (New NiFi Registry Instance)
  
negative.code: |`Authentication Expiration` | The duration of how long the user authentication is valid for. If the user never logs out, they will be required to log back in following this duration.
  |==================================================================================================================================================
  
  [[kerberos_identity_provider]]
  Kerberos
  ~~~~~~~~
  
  Below is an example and description of configuring an Identity Provider that integrates with a Kerberos Key Distribution Center (KDC) to authenticate users.
  
  ----
  <provider>
  