anchor.diff:  Assign users with the `kibana_user` role to the `kibana_admin` role.
   Discontinue use of the `kibana_user` role.
   ====
  +
   // end::notable-breaking-changes[]
   
   // These are non-notable changes
  
positive.code: 
  [discrete]
  [[ssl-misc-changes]]
  ===== Other SSL/TLS changes 
  
  .PKCS#11 keystores and trustores cannot be configured in `elasticsearch.yml`
  [%collapsible]
  
negative.code: ====
  
  [discrete]
  [[saml-realm-nameid-changes]]
  .The `nameid_format` SAML realm setting no longer has a default value.
  [%collapsible]
  ====
  *Details* +
  In SAML, Identity Providers (IdPs) can either be explicitly configured to
  release a `NameID` with a specific format, or configured to attempt to conform 
  with the requirements of a Service Provider (SP). The SP declares its
  requirements in the `NameIDPolicy` element of a SAML Authentication Request.
  In {es}, the `nameid_format` SAML realm setting controls the `NameIDPolicy`
  value.
  
  Previously, the default value for `nameid_format` was
  `urn:oasis:names:tc:SAML:2.0:nameid-format:transient`. This setting created
  authentication requests that required the IdP to release `NameID` with a
  `transient` format.
  
  The default value has been removed, which means that {es} will create SAML Authentication Requests by default that don't put this requirement on the
  IdP. If you want to retain the previous behavior, set `nameid_format` to
  `urn:oasis:names:tc:SAML:2.0:nameid-format:transient`.
  
  *Impact* +
  If you currently don't configure `nameid_format` explicitly, it's possible
  that your IdP will reject authentication requests from {es} because the requests 
  do not specify a `NameID` format (and your IdP is configured to expect one).
  This mismatch can result in a broken SAML configuration. If you're unsure whether 
  your IdP is explicitly configured to use a certain `NameID` format and you want to retain current behavior
  , try setting `nameid_format` to `urn:oasis:names:tc:SAML:2.0:nameid-format:transient` explicitly.
  ====
  
  [discrete]
  [[ssl-validation-changes]]
  ===== SSL/TLS configuration validation
  
  