anchor.diff:  the CLI) are sent a `WWW-Authenticate` challenge header for this provider.
   <3> When *true*, unauthenticated token requests from web clients (like the web
   console) are redirected to a login page backed by this provider.
  +<4> Controls how mappings are established between this provider's identities and user objects,
  +link:#mapping-identities-to-users[as described above].
   ====
   
   [[DenyAllPasswordIdentityProvider]]
  
positive.code:   - name: google <1>
      challenge: false <2>
      login: true <3>
      provider:
        apiVersion: v1
        kind: GoogleIdentityProvider
        clientID: ... <4>
        clientSecret: ... <5>
        hostedDomain: "" <6>
  ----
  <1> This provider name is prefixed to the Google numeric user ID to form an
  identity name. It is also used to build the redirect URL.
  
negative.code: CLI) are sent a `WWW-Authenticate` challenge header for this provider.
  <3> When *true*, unauthenticated token requests from web clients (like the web
  console) are redirected to a login page backed by this provider.
  <4> Controls how mappings are established between this provider's identities and user objects,
  link:#mapping-identities-to-users[as described above].
  <5> URL accepting credentials in Basic authentication headers.
  <6> Optional: Certificate bundle to use to validate server certificates for the
  configured URL.
  <7> Optional: Client certificate to present when making requests to the
  configured URL.
  <8> Key for the client certificate. Required if `*certFile*` is specified.
  ====
  
  [[RequestHeaderIdentityProvider]]
  