anchor.diff:        apiVersion: v1
         kind: KeystonePasswordIdentityProvider
         domainName: default <5>
  -      ca: ca.pem <6> 
  -      certFile: keystone.pem <7> 
  -      keyFile: keystonekey.pem <8> 
  +      ca: ca.pem <6>
  +      certFile: keystone.pem <7>
  +      keyFile: keystonekey.pem <8>
   ----
   <1> This provider name is prefixed to provider user names to form an identity name.
   <2> When *true*, unauthenticated token requests from non-web clients (like the
  
positive.code: user for this identity. First non-empty attribute is used.
  <9> Optional DN to use to bind during the search phase.
  <10> Optional password to use to bind during the search phase. This value may also be provided in an
  link:../install_config/master_node_configuration.html#passwords[environment 
  variable, external file, or encrypted file].
  <11> Certificate bundle to use to validate server certificates for the
  configured URL. If empty, system trusted roots are used. Only applies if
  
negative.code: Google project]. The project must be configured with a redirect URI of
  `<master>/oauth2callback/<identityProviderName>`.
  <6> The client secret issued by Google. This value may also be provided in an
  link:../install_config/master_node_configuration.html#passwords[environment
  variable, external file, or encrypted file].
  <7> Optional
  link:https://developers.google.com/identity/protocols/OpenIDConnect#hd-param[hosted
  