anchor.diff:          - name
           email:
           - email
  -      issuer:
  -        authorize: https://myidp.example.com/oauth2/authorize <6>
  -        token: https://myidp.example.com/oauth2/token <7>
  +      issuer: https://www.idp-issuer.com <6>
   ----
   <1> This provider name is prefixed to the value of the identity claim to form an
   identity name. It is also used to build the redirect URL.
  
positive.code: <5> List of claims to use as the identity. First non-empty claim is used. At
  least one claim is required. If none of the listed claims have a value,
  authentication fails. For example, this uses the value of the `sub` claim in the returned `id_token` as the user's identity.
  <6> link:http://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint[Authorization Endpoint]
  described in the OpenID spec. Must use `https`.
  <7> link:http://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint[Token Endpoint]
  described in the OpenID spec. Must use `https`.
  
  .Full OpenID Connect CR
  
  
negative.code: for this identity. First non-empty claim is used.
  <5> List of claims to use as the display name. First non-empty claim is used.
  <6> List of claims to use as the email address. First non-empty claim is used.
  