anchor.diff:              uri ${config.users.ldap.server}
               base ${config.users.ldap.base}
   
  -            ${if config.users.ldap.useTLS then ''
  +            ${optionalString config.users.ldap.useTLS ''
                 ssl start_tls
                 tls_checkpeer no
  -            '' else ""}
  +            ''}
  +
  +            ${optionalString (config.users.ldap.bind.distinguishedName != "") ''
  +              binddn ${config.users.ldap.bind.distinguishedName}
  +            ''}
             '';
           target = "ldap.conf";
         }
  
positive.code:           ";
          };
  
        };
      };
    };
  
negative.code: 
  ###### interface
  let
    inherit (pkgs.lib) mkOption mkIf optionalString stringAfter;
  
    options = {
      users = {
  