anchor.diff:    - name: my_allow_provider <1>
       challenge: true <2>
       login: true <3>
  +    mappingMethod: claim <4>
       provider:
         apiVersion: v1
         kind: AllowAllPasswordIdentityProvider
  
positive.code: challenges.
  <3> When *true*, unauthenticated token requests from web clients (like the web
  console) are redirected to Google to log in.
  <4> The client ID of a link:https://console.developers.google.com/[registered
  Google project]. The project must be configured with a redirect URI of
  `<master>/oauth2callback/<identityProviderName>`.
  <5> The client secret issued by Google.
  <6> Optional
  link:https://developers.google.com/identity/protocols/OpenIDConnect#hd-param[hosted
  domain] to restrict sign-in accounts to. If empty, any Google account is allowed
  to authenticate.
  
negative.code:   - name: my_openid_connect
      challenge: false
      login: true
      mappingMethod: claim
      provider:
        apiVersion: v1
        kind: OpenIDIdentityProvider
  