anchor.diff:  
   As far as tenant configuration goes, it is possible to create tenants directly from Kaui. If you already have created a tenant in Kill Bill using APIs, you can safely re-create it from Kaui, which will discover it on the server side and simply sync it locally.
   
  -== Super user
  +=== Super user
   
   Kaui has the concept of a super user (*root*) for critical, cross-tenants, operations. By default, it assumes that the `admin` user is the super user, but you can change this by setting the system property `kaui.root_username` (`KAUI_ROOT_USERNAME` Docker environment variable). The password doesn't need to be specified as it is stored on the server side (`shiro.ini`, etc.).
   
  -= Summary
  +== Summary
   
   1. User, roles, permissions need to be configured on the server side (`shiro.ini`, database, LDAP, Okta, ...)
   2. Tenants can then be created (using a user whole role's permissions allow such operation)
  
positive.code: 
  Fields to populate will depend on which back-end realm is configured.
  
  === Database
  
  If you are storing roles, usernames and passwords in the Kill Bill database, leave the "Managed externally" checkbox unchecked and fill-in all details. Kaui will create these users locally and in Kill Bill (if they don't exist on the server already).
  
  Roles can be created by going to `/role_definitions/new`.
  
  === LDAP and Okta
  
  If you are delegating roles and users management to a third-party system, Kaui only needs to know the login of the users. Password and roles being managed outside of Kill Bill, you need to access your third-party system to set and update these.
  
  Note that there is no auto-discovery of logins: you need to enter all logins from your system manually in Kaui before such users can access the UI.
  
  == Users and tenants
  
  Kaui needs to be told about the relationship between user and tenants (this mapping is specific to the UI). The idea, is that a super admin would first configure the allowed users for each specific tenant on the KAUI side, in such a way that later on, when a specific user logs in, he only sees the tenants he has access to.
  
  
negative.code: [source,bash]
  ----
  curl -v \
       -u cs:cs123 \
       -H "X-Killbill-ApiKey: bob" \
       -H "X-Killbill-ApiSecret: lazar" \
       -H "Content-Type: application/json" \
       -H "X-Killbill-CreatedBy: demo" \
       -X POST \
       --data-binary '{"name":"John Doe","email":"john@example.com","externalKey":"john-doe-1234","currency":"USD"}' \
       "http://127.0.0.1:8080/1.0/kb/accounts"
  ----
  
  But the following curl to refund a payment would fail because his role `customer_support` does not include the permission `payment:refund`:
  