anchor.diff:  <5> List of claims to use as the identity. First non-empty claim is used. At
   least one claim is required. If none of the listed claims have a value,
   authentication fails. For example, this uses the value of the `sub` claim in the returned `id_token` as the user's identity.
  -<6> link:http://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint[Authorization Endpoint]
  -described in the OpenID spec. Must use `https`.
  -<7> link:http://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint[Token Endpoint]
  -described in the OpenID spec. Must use `https`.
  +<6> link:https://openid.net/specs/openid-connect-core-1_0.html#IssuerIdentifier[Issuer Identifier]
  +described in the OpenID spec. Must use `https` without query or fragment
  +component.
   
   .Full OpenID Connect CR
   
  
positive.code:         email: <6>
          - custom_email_claim
          - email
        issuer:
          authorize: https://myidp.example.com/oauth2/authorize
          token: https://myidp.example.com/oauth2/token
          userInfo: https://myidp.example.com/oauth2/userinfo <7>
  
  ----
  <1> Optional: Reference to an {product-title} ConfigMap containing the
  
negative.code: parameters, or a `userInfo` URL, use the full OpenID Connect CR.
  
  .Standard OpenID Connect CR
  [source,yaml]
  ----
  apiVersion: config.openshift.io/v1
  