anchor.diff:  Google project]. The project must be configured with a redirect URI of
   `<master>/oauth2callback/<identityProviderName>`.
   <6> The client secret issued by Google. This value may also be provided in an
  -link:../install_config/master_node_configuration.html#passwords[environment 
  +link:../install_config/master_node_configuration.html#passwords[environment
   variable, external file, or encrypted file].
   <7> Optional
   link:https://developers.google.com/identity/protocols/OpenIDConnect#hd-param[hosted
  
positive.code:       apiVersion: v1
        kind: KeystonePasswordIdentityProvider
        domainName: default <5>
        ca: ca.pem <6> 
        certFile: keystone.pem <7> 
        keyFile: keystonekey.pem <8> 
  ----
  <1> This provider name is prefixed to provider user names to form an identity name.
  <2> When *true*, unauthenticated token requests from non-web clients (like the
  
negative.code: application]. The application must be configured with a callback URL of
  `<master>/oauth2callback/<identityProviderName>`.
  <6> The client secret issued by GitHub. This value may also be provided in an
  link:../install_config/master_node_configuration.html#passwords[environment
  variable, external file, or encrypted file].
  <7> Optional list of organizations. If specified, only GitHub users that are members of
  at least one of the listed organizations will be allowed to log in. If the GitHub OAuth
  application configured in *clientID* is not owned by the organization, an organization
  owner must grant third-party access in order to use this option. This can be done during
  the first GitHub login by the organization's administrator, or from the GitHub organization settings.
  ====
  
  [[GitLab]]
  