anchor.diff:  [source,bash]
   ----
   curl -v \
  --u cs:cs123 \
  --H "X-Killbill-ApiKey: bob" \
  --H "X-Killbill-ApiSecret: lazar" \
  --H "Content-Type: application/json" \
  --H "X-Killbill-CreatedBy: demo" \
  --X POST \
  ---data-binary '{"name":"John Doe","email":"john@example.com","externalKey":"john-doe-1234","currency":"USD"}' \
  -"http://127.0.0.1:8080/1.0/kb/accounts"
  +     -u cs:cs123 \
  +     -H "X-Killbill-ApiKey: bob" \
  +     -H "X-Killbill-ApiSecret: lazar" \
  +     -H "Content-Type: application/json" \
  +     -H "X-Killbill-CreatedBy: demo" \
  +     -X POST \
  +     --data-binary '{"name":"John Doe","email":"john@example.com","externalKey":"john-doe-1234","currency":"USD"}' \
  +     "http://127.0.0.1:8080/1.0/kb/accounts"
   ----
   
   But the following curl to refund a payment would fail because his role `customer_support` does not include the permission `payment:refund`:
  
positive.code: 
  Fields to populate will depend on which back-end realm is configured.
  
  === Database
  
  If you are storing roles, usernames and passwords in the Kill Bill database, leave the "Managed externally" checkbox unchecked and fill-in all details. Kaui will create these users locally and in Kill Bill (if they don't exist on the server already).
  
  Roles can be created by going to `/role_definitions/new`.
  
  === LDAP and Okta
  
  If you are delegating roles and users management to a third-party system, Kaui only needs to know the login of the users. Password and roles being managed outside of Kill Bill, you need to access your third-party system to set and update these.
  
  Note that there is no auto-discovery of logins: you need to enter all logins from your system manually in Kaui before such users can access the UI.
  
  == Users and tenants
  
  Kaui needs to be told about the relationship between user and tenants (this mapping is specific to the UI). The idea, is that a super admin would first configure the allowed users for each specific tenant on the KAUI side, in such a way that later on, when a specific user logs in, he only sees the tenants he has access to.
  
  
negative.code: [source,bash]
  ----
  curl -v \
       -u cs:cs123 \
       -H "X-Killbill-ApiKey: bob" \
       -H "X-Killbill-ApiSecret: lazar" \
       -H "Content-Type: application/json" \
       -H "X-Killbill-CreatedBy: demo" \
       -X POST \
       --data-binary '{"amount":"12.4"}' \
       "http://127.0.0.1:8080/1.0/kb/invoicePayments/288983f2-5143-47e4-b967-b8962fc699d1/refunds"
  ----
  
  === LDAP configuration
  
  To enable LDAP, Kill Bill needs to be launched with the following System Properties:
  
  ```
  killbill.server.ldap=true
  # Take a look at your LDAP configuration for the following properties
  org.killbill.security.ldap.dnSearchTemplate=
  org.killbill.security.ldap.searchBase=
  org.killbill.security.ldap.groupSearchFilter=
  org.killbill.security.ldap.groupNameId=
  org.killbill.security.ldap.url=
  org.killbill.security.ldap.disableSSLCheck=
  org.killbill.security.ldap.systemUsername=
  org.killbill.security.ldap.systemPassword=
  org.killbill.security.ldap.authenticationMechanism=
  org.killbill.security.ldap.permissionsByGroup=
  ```
  
  Notes:
  
  * If no groups are defined in LDAP, all users will only have read-only permissions
  * Before an LDAP user can use Kaui, an admin needs to associate his login to the right tenants (see below)
  
  
  == KAUI
  
  KAUI has been extended to understand all the user/role/permission management and will manage the corresponding sessions. Some of those implementation details were covered in http://killbill.io/blog/multi-tenancy-authorization[our previous blog post].
  
  === Users
  
  To configure users allowed to use Kaui, go to `/admin_allowed_users`:
  
  