anchor.diff:  ====
   
   . Generate the API client certificate that the authenticating proxy will use
  -to prove its identity to {product-title}. This is necessary and prevents
  -malicious users from impersonating the proxy and sending fake identities.
  +to prove its identity to {product-title}:
  ++
  +====
  +----
  +# oadm create-api-client-config \
  +    --certificate-authority='/etc/origin/proxy/proxyca.crt' \ --client-dir='/etc/origin/proxy' \ --signer-cert='/etc/origin/proxy/proxyca.crt' \ --signer-key='/etc/origin/proxy/proxyca.key' \ --signer-serial='/etc/origin/proxy/proxyca.serial.txt' \ --user='system:proxy'
  +----
  +====
  +
  +. Copy the certificate and key information to the appropriate file for future
  +steps:
  ++
  +====
  +----
  +# cat /etc/origin/proxy/system:proxy.crt /etc/origin/proxy/system:proxy.key > /etc/origin/proxy/authproxy.pem
  +----
  +====
  ++
  +This prevents malicious users from impersonating the proxy and sending fake
  +identities.
   
   . Create a new CA to sign this client certificate:
   +
  
positive.code: 
  ====
  ----
  # scp /etc/origin/proxy/master/ca.crt \
        root@proxy.example.com:/etc/pki/CA/certs/
  
  # scp /etc/origin/proxy/proxy.example.com.crt \
  
negative.code: ====
  +
  This gives you the needed SSSD and the web server components.
  
  . Edit the /etc/httpd/conf.modules.d/55-authnz_pam.conf file and remove the comment from the following:
  +
  ====
  ----
  LoadModule authnz_pam_module modules/mod_authnz_pam.so
  ----
  ====
  
  . Set up SSSD to authenticate this VM against the LDAP server. If the LDAP server
  is a FreeIPA or Active Directory environment, then *realmd* can be used to join
  