anchor.diff:  rp.post_logout_redirect_uri::
       (Optional) The Redirect URL where the OpenID Connect Provider should redirect the user after a
       successful Single Logout (assuming `op.endsession_endpoint` above is also set). This should be set to a value that
  -    will not trigger a new OpenID Connect Authentication, such as +$\{kibana-url}/logged_out+ where _$\{kibana-url}_ is
  -    the base URL for your {kib} instance.
  +    will not trigger a new OpenID Connect Authentication, such as +$\{kibana-url}/security/logged_out+  or
  +    +$\{kibana-url}/login?msg=LOGGED_OUT+ where _$\{kibana-url}_ is the base URL for your {kib} instance.
   
   claims.principal:: See <<oidc-claims-mapping>>.
   claims.groups:: See <<oidc-claims-mapping>>.
  
positive.code: 
  When configuring `rp.post_logout_redirect_uri`, care should be taken to not point this to a URL that
  will trigger re-authentication of the user. For instance, when using OpenID Connect to support
  single sign-on to {kib}, this could be set to +$\{kibana-url}/logged_out+,  which will show a user-
  friendly message to the user.
  
  [[oidc-ssl-config]]
  ==== OpenID Connect Realm SSL Configuration
  
negative.code:   op.jwkset_path: oidc/jwkset.json
    op.userinfo_endpoint: "https://op.example.org/oauth2/v1/userinfo"
    op.endsession_endpoint: "https://op.example.org/oauth2/v1/logout"
    rp.post_logout_redirect_uri: "https://kibana.example.org:5601/security/logged_out"
    claims.principal: sub
    claims.groups: "http://example.info/claims/groups"
  -------------------------------------------------------------------------------------
  