anchor.diff:    - name: "my_ldap_provider" <1>
       challenge: true <2>
       login: true <3>
  +    mappingMethod: claim <4>
       provider:
         apiVersion: v1
         kind: LDAPPasswordIdentityProvider
         attributes:
  -        id: <4>
  +        id: <5>
           - dn
  -        email: <5>
  +        email: <6>
           - mail
  -        name: <6>
  +        name: <7>
           - cn
  -        preferredUsername: <7>
  +        preferredUsername: <8>
           - uid
  -      bindDN: "" <8>
  -      bindPassword: "" <9>
  -      ca: my-ldap-ca-bundle.crt <10>
  -      insecure: false <11>
  -      url: "ldap://ldap.example.com/ou=users,dc=acme,dc=com?uid" <12>
  +      bindDN: "" <9>
  +      bindPassword: "" <10>
  +      ca: my-ldap-ca-bundle.crt <11>
  +      insecure: false <12>
  +      url: "ldap://ldap.example.com/ou=users,dc=acme,dc=com?uid" <13>
   ----
   <1> This provider name is prefixed to the returned user ID to form an identity
   name.
  
positive.code: challenges.
  <3> When *true*, unauthenticated token requests from web clients (like the web
  console) are redirected to GitHub to log in.
  <4> The client ID of a
  link:https://github.com/settings/applications/new[registered GitHub OAuth
  application]. The application must be configured with a callback URL of
  `<master>/oauth2callback/<identityProviderName>`.
  <5> The client secret issued by GitHub.
  ====
  
  [[Google]]
  
negative.code: the CLI) are sent a `WWW-Authenticate` challenge header for this provider.
  <3> When *true*, unauthenticated token requests from web clients (like the web
  console) are redirected to a login page backed by this provider.
  <4> Controls how mappings are established between this provider's identities and user objects,
  link:#mapping-identities-to-users[as described above].
  ====
  
  [[DenyAllPasswordIdentityProvider]]
  