anchor.diff:        kind: GoogleIdentityProvider
         clientID: ... <4>
         clientSecret: ... <5>
  +      hostedDomain: "" <6>
   ----
   <1> This provider name is prefixed to the Google numeric user id to form an identity name. It is also used to build the redirect URL.
   <2> `GoogleIdentityProvider` cannot be used to send WWW-Authenticate challenges.
   <3> When `true`, unauthenticated token requests from web clients (like the web console) will be redirected to Google to log in.
   <4> The client id of a link:https://console.developers.google.com/[registered Google project]. The project must be configured with a redirect URI of `<master>/oauth2callback/<identityProviderName>`
   <5> The client secret issued by Google.
  +<6> Optional link:https://developers.google.com/identity/protocols/OpenIDConnect#hd-param[hosted domain] to restrict sign-in accounts to. If empty, any Google account is allowed to authenticate.
   ====
   
   ==== OpenID Connect [[OpenID]]
  
positive.code: <8> link:http://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint[Token Endpoint] described in the OpenID spec. Must use https.
  ====
  
  A custom certificate bundle, extra scopes, and UserInfo URL can also be specified.
  
  Full config:
  ====
  
negative.code: 
  When running without a master config file, the `AllowAllPasswordIdentityProvider` identity provider is used, which allows any non-empty username and password to log in. This is useful for test purposes.
  
  To use other identity providers, you must run from a config file. For more information about creating and running from config files, see link:../../dev_guide/master_node_configuration.html[Master and Node Configuration].
  
  === Identity providers
  
  