anchor.diff:  <8> link:http://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint[Token Endpoint] described in the OpenID spec. Must use https.
   ====
   
  -A custom certificate bundle, extra scopes, and UserInfo URL can also be specified.
  +A custom certificate bundle, extra scopes, extra authorization request parameters, and UserInfo URL can also be specified.
   
   Full config:
   ====
  
positive.code:       extraScopes: <2>
        - email
        - profile
        claims:
          id: <3>
          - custom_id_claim
          - sub
          preferredUsername: <4>
          - preferred_username
          - email
          name: <5>
          - nickname
          - given_name
          - name
          email: <6>
          - custom_email_claim
          - email
        urls:
          authorize: https://myidp.example.com/oauth2/authorize
          token: https://myidp.example.com/oauth2/token
          userInfo: https://myidp.example.com/oauth2/userinfo <7>
  ----
  <1> Certificate bundle to use to validate server certificates for the configured URLs. If empty, system trusted roots are used.
  <2> List of scopes to request (in addition to the `openid` scope) during the authorization request.
  <3> List of claims to use as the identity. First non-empty claim is used. At least one claim is required. If none of the listed claims have a value, authentication will fail.
  <4> List of claims to use as the preferred username when provisioning a user for this identity. First non-empty claim is used.
  <5> List of claims to use as the display name. First non-empty claim is used.
  <6> List of claims to use as the email address. First non-empty claim is used.
  <7> link:http://openid.net/specs/openid-connect-core-1_0.html#UserInfo[UserInfo Endpoint] described in the OpenID spec. Must use https.
  ====
  
  === Token options
  
negative.code: 
  When running without a master config file, the `AllowAllPasswordIdentityProvider` identity provider is used, which allows any non-empty username and password to log in. This is useful for test purposes.
  
  To use other identity providers, you must run from a config file. For more information about creating and running from config files, see link:../../dev_guide/master_node_configuration.html[Master and Node Configuration].
  
  === Identity providers
  
  