anchor.diff:    - name: my_allow_provider <1>
       challenge: true <2>
       login: true <3>
  +    mappingMethod: claim <4>
       provider:
         apiVersion: v1
         kind: AllowAllPasswordIdentityProvider
  
positive.code:   - name: "my_ldap_provider" <1>
      challenge: true <2>
      login: true <3>
      provider:
        apiVersion: v1
        kind: LDAPPasswordIdentityProvider
        attributes:
          id: <4>
          - dn
          email: <5>
          - mail
          name: <6>
          - cn
          preferredUsername: <7>
          - uid
        bindDN: "" <8>
        bindPassword: "" <9>
        ca: my-ldap-ca-bundle.crt <10>
        insecure: false <11>
        url: "ldap://ldap.example.com/ou=users,dc=acme,dc=com?uid" <12>
  ----
  <1> This provider name is prefixed to the returned user ID to form an identity
  name.
  
negative.code: <3> *RequestHeaderIdentityProvider* can only respond to clients requesting a
  login flow by redirecting to a configured `loginURL`. The configured URL should
  respond with a login flow.
  <4> Controls how mappings are established between this provider's identities and user objects,
  link:#mapping-identities-to-users[as described above].
  <5> Optional: URL to redirect unauthenticated _/oauth/authorize_ requests to,
  for clients which expect interactive logins. _${url}_ is replaced with the
  current URL, escaped to be safe in a query parameter. _${query}_ is replaced
  with the current query string.
  <6> Optional: URL to redirect unauthenticated _/oauth/authorize_ requests to,
  for clients which expect `WWW-Authenticate` challenges. _${url}_ is replaced
  with the current URL, escaped to be safe in a query parameter. _${query}_ is
  replaced with the current query string.
  <7> Optional: PEM-encoded certificate bundle. If set, a valid client certificate
  must be presented and validated against the certificate authorities in the
  specified file before the request headers are checked for user names.
  <8> Header names to check, in order, for user names. The first header containing
  a value is used as the user name. Required, case-insensitive.
  ====
  
  