anchor.diff:  <3> When `true`, unauthenticated token requests from web clients (like the web console) will be redirected to GitHub to log in.
   <4> The client id of a link:https://github.com/settings/applications/new[registered GitHub OAuth application]. The application must be configured with a callback URL of `<master>/oauth2callback/<identityProviderName>`
   <5> The client secret issued by GitHub.
  +====
   
   ==== Google [[Google]]
   
  
positive.code: <1> Controls the maximum age of a session (sessions auto-expire once a token request is complete). If auto-grant is not enabled, sessions must last as long as the user is expected to take to approve or reject a client authorization request.
  <2> Name of the cookie used to store the session.
  <3> Filename containing serialized SessionSecrets object. If empty, a random signing and encryption secret is generated at each server start.
  
  Multiple secrets can be specified in the `sessionSecretsFile` to enable rotation. New sessions are signed and encrypted using the first secret in the list. Existing sessions are decrypted/authenticated by each secret until one succeeds.
  
  Session secret config:
  ----
  apiVersion: v1
  kind: SessionSecrets
  
negative.code: To specify the signing and encryption secret to use, specify a `sessionSecretsFile`. This allows you separate secret values from the config file, and keep the config file distributable for debugging, etc.
  
  Master config:
  ====
  ----
  oauthConfig:
    ...
  