anchor.diff:  <1> This provider name is prefixed to logins to form an identity name.
   <2> When `true`, unauthenticated token requests from non-web clients (like `osc`) will be sent a WWW-Authenticate challenge header for this provider.
   <3> When `true`, unauthenticated token requests from web clients (like the web console) will be redirected to a login page backed by this provider.
  +====
   
   ==== HTPasswd [[HTPasswdPasswordIdentityProvider]]
   
  
positive.code: <3> When `true`, unauthenticated token requests from web clients (like the web console) will be redirected to GitHub to log in.
  <4> The client id of a link:https://github.com/settings/applications/new[registered GitHub OAuth application]. The application must be configured with a callback URL of `<master>/oauth2callback/<identityProviderName>`
  <5> The client secret issued by GitHub.
  
  ==== Google [[Google]]
  
  
negative.code: <6> Use the value of the `sub` claim in the returned `id_token` as the user's identity.
  <7> link:http://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint[Authorization Endpoint] described in the OpenID spec. Must use https.
  <8> link:http://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint[Token Endpoint] described in the OpenID spec. Must use https.
  ====
  
  A custom certificate bundle, extra scopes, and UserInfo URL can also be specified.
  
  Full config:
  ====
  ----
  oauthConfig:
    ...
  