anchor.diff:  +
   The custom web application will then need to also handle the response, which will include a `redirect`
   parameter with a URL in the IdP that contains the SAML Logout response. The application should redirect the user
  -there to complete the logout. 
  +there to complete the logout.
  
positive.code: - `metadata`: See <<saml-user-metadata>>
  
  For more information, see <<mapping-roles>> and
  <<security-role-mapping-apis>>. 
  
  If your IdP has the ability to provide groups or roles to Service Providers,
  then you should map this SAML attribute to the `attributes.groups` setting in
  
negative.code: If the SAML realm is configured accordingly and the IdP supports it (see <<saml-logout>>), this request will trigger a SAML
  SP-initiated Single Logout. In this case, the response will include a `redirect`
  parameter indicating where the user needs to be redirected at the IdP in order to complete the logout.
  . Alternatively, the IdP might initiate the Single Logout flow at some point. In order to handle this,
  the Logout URL (`sp.logout`) needs to be handled by the custom web app. The query part of the URL that the
  user will be redirected to will contain a SAML Logout request and this query part needs to be relayed to {es}
  using the <<security-api-saml-invalidate,SAML invalidate API>>
  +
  [source,console]
  --------------------------------------------------
  