anchor.diff:   https://127.0.0.1:8443/apiman-gateway/Newcastle/EchoService/2.0/rincewind/wizard
   {
     "method" : "GET",
  -  "resource" : "/services/echo/rincewind/wizard",
  -  "uri" : "/services/echo/rincewind/wizard",
  +  "resource" : "/apiman-echo/rincewind/wizard",
  +  "uri" : "/apiman-echo/rincewind/wizard",
     "headers" : {
       "Authorization" : "Bearer eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiJmODAyZjFmMy1kN2JmLTQ0YjQtODA2N...",
       "Host" : "127.0.0.1:8080",
  
positive.code: - `Authorization` header, as `Authorization: Bearer <token>`
  - `access_token` query parameter, as `http://example.org/the/path/?access_token=<token>`
  
  First, let's retrieve a fresh token, and extract the `access_token` field
  
  ```
  curl -X POST http://127.0.0.1:8080/auth/realms/stottie/protocol/openid-connect/token  -H "Content-Type: application/x-www-form-urlencoded" -d "username=rincewind" -d 'password=apiman' -d 'grant_type=password' -d 'client_id=apiman' | jsawk 'return this.access_token'
  ```
  
  Second, we'll take the token and attach it to our request to the service
  
negative.code: 
  There are two essential components to our system. First, is the http://keycloak.jboss.org[Keycloak server], an all-in-one https://en.wikipedia.org/wiki/Single_sign-on[SSO] and https://en.wikipedia.org/wiki/Identity_management[IdM]; we'll configure it to be our identity source and handle the issuance of OAuth2 bearer tokens. Second, is the apiman OAuth2 policy; we'll set it up to validate the tokens precisely to our requirements.
  
  Let's assume we're going to protect a very simple *echo service*, which echoes back to the requestor the details of any request made to it. It is located at `http://localhost:8080/apiman-echo`.
  
  === Keycloak Server
  
  