anchor.diff:  
   ====
   ----
  -# scp /etc/origin/proxy/master/ca.crt \
  +# scp /etc/origin/master/ca.crt \
         root@proxy.example.com:/etc/pki/CA/certs/
   
   # scp /etc/origin/proxy/proxy.example.com.crt \
  
positive.code: ====
  
  . Generate the API client certificate that the authenticating proxy will use
  to prove its identity to {product-title}. This is necessary and prevents
  malicious users from impersonating the proxy and sending fake identities.
  
  . Create a new CA to sign this client certificate:
  +
  
negative.code: ====
  +
  This gives you the needed SSSD and the web server components.
  
  . Edit the /etc/httpd/conf.modules.d/55-authnz_pam.conf file and remove the comment from the following:
  +
  ====
  ----
  LoadModule authnz_pam_module modules/mod_authnz_pam.so
  ----
  ====
  
  . Set up SSSD to authenticate this VM against the LDAP server. If the LDAP server
  is a FreeIPA or Active Directory environment, then *realmd* can be used to join
  