anchor.diff:  .*;http://fallback:8080
   ----
   
  +In this example, the following occurs:
  +
  +* The special value NO_PROXY for the proxy-uri is used, which means that no proxy is used for hosts matching the associated hostname pattern.
  +* A catch-all pattern ends the proxy-mappings, providing a default proxy for all outgoing requests.
  +
   == Outgoing HTTPS request truststore
  -When Keycloak calls remote HTTPS endpoints, it has to validate the remote server's certificate in order to ensure it is connecting to a trusted server. This is necessary in order to prevent man-in-the-middle attacks.  The certificates of these remote servers or the CA that signed these certificates must be put in a truststore.
  +When Keycloak calls remote HTTPS endpoints, it has to validate the remote server's certificate to ensure it is connecting to a trusted server. This validation is necessary to prevent man-in-the-middle attacks. The certificates of these remote servers or the CA that signed these certificates must be put in a truststore.
   
  -This truststore is used to securely connect e.g. to identity brokers, LDAP identity providers, when sending emails, and for backchannel communication with client applications.
  +This truststore is used to securely connect to identity brokers, LDAP identity providers, when sending emails, and for backchannel communication with client applications. When no truststore is configured, outgoing HTTPS connections use the standard java truststore configuration by default. When no trust can be established, outgoing HTTPS requests fail.
   
  -When no truststore is configured, outgoing https connection will use the standard java truststore configuration by default. When no trust can be established, outgoing HTTPS requests will fail.
  -
  -You can add your truststore configuration by using:
  +You can add your truststore configuration by entering this command:
   
   <@kc.start parameters="--spi-truststore-file-file=myTrustStore.jks --spi-truststore-file-password=password --spi-truststore-file-hostname-verification-policy=ANY"/>
   
  -Possible configuration options for this setting are:
  +The following are possible configuration options for this setting:
   
   file::
   The path to a Java keystore file.
  -HTTPS requests need a way to verify the host of the server they are talking to.
  -This is what the trustore does.
  +HTTPS requests need a way to verify the host of the server to which they are talking.
  +This is what the truststore does.
   The keystore contains one or more trusted host certificates or certificate authorities.
   This truststore file should only contain public certificates of your secured hosts.
   This is _REQUIRED_ if any of these properties are defined.
   
   password::
   Password of the keystore.
  -This is _REQUIRED_ if any of these properties are defined.
  +This option is _REQUIRED_ if any of these properties are defined.
   
   hostname-verification-policy::
  -For HTTPS requests, this verifies the hostname of the server's certificate.
  -`ANY` means that the hostname is not verified. `WILDCARD` Allows wildcards in subdomain names, e.g.
  -*.foo.com. When using `STRICT`, the Common Name (CN) must match the hostname exactly. Default: `WILDCARD`
  +For HTTPS requests, this option verifies the hostname of the server's certificate. Default: `WILDCARD`
  +* `ANY` means that the hostname is not verified.
  +* `WILDCARD` allows wildcards in subdomain names, such as *.foo.com.
  +* When using `STRICT`, the Common Name (CN) must match the hostname exactly.
   
  -.Example
  -An example configuration for a truststore that allows you to create trustful connections to all `mycompany.org` domains and it's subdomains is shown below:
  +=== Example of a truststore configuration
  +The following is an example configuration for a truststore that allows you to create trustful connections to all `mycompany.org` domains and its subdomains:
   
  -<kc.start parameters="--spi-truststore-file-file=path/to/truststore.jks --spi-truststore-file-password=change_me --spi-truststore-file-hostname-verification-policy=WILDCARD"/>
  +<@kc.start parameters="--spi-truststore-file-file=path/to/truststore.jks --spi-truststore-file-password=change_me --spi-truststore-file-hostname-verification-policy=WILDCARD"/>
   
  -</@tmpl.guide>+</@tmpl.guide>
  
positive.code: Maximum connection time to live in milliseconds. Default: Not set.
  
  *max-connection-idle-time-millis*::
  Maximum time an idle connection stays in the connection pool, in milliseconds. Idle connections will be removed from the pool by a background cleaner thread. Set to -1 to disable this check. Default: 900000.
  
  *disable-cookies*::
  Enable or disable caching of cookies. Default: true.
  
negative.code: summary="How to configure the client used for outgoing HTTP requests."
  includedOptions="">
  
  Keycloak often needs to make requests to the applications and services that it secures. Keycloak manages these outgoing connections using an HTTP client. This guide shows how to configure the client, connection pool, proxy environment settings, timeouts, and more.
  
  == Client Configuration Command
  The HTTP client that Keycloak uses for outgoing communication is highly configurable. To configure the Keycloak outgoing HTTP client, enter this command:
  
  <@kc.start parameters="--spi-connections-http-client-default-<configurationoption>=<value>"/>
  
  The following are the command options:
  
  *establish-connection-timeout-millis*::
  Maximum time in milliseconds until establishing a connection times out. Default: Not set.
  