anchor.diff:  
   		#  Server side result sorting
   		#
  -		#  A list of space delimited attributes to order the result
  -		#  set by, if the filter matches multiple objects.
  -		#  Only the first result in the set will be processed.
  +		#  A list of space delimited attributes to order the result set by.
  +		#
  +		#  If the filter matches multiple objects only the first
  +		#  result will be processed.
   		#
   		#  If the attribute name is prefixed with a hyphen '-' the
   		#  sorting order will be reversed for that attribute.
   		#
   		#  If sort_by is set, and the server does not support sorting
   		#  the search will fail.
  +		#
  +		#  If a search returns multiple user objects and sort_by is not
  +		#  set, the search will fail.
   #		sort_by = '-uid'
   
   		#  If this is undefined, anyone is authorised.
  
positive.code: 	#  mapped attributes.
  	#
  	#  Values should be in the format:
  	#  	<radius attr> <op> <value>
  	#
  	#  Where:
  	#  	<radius attr>:	Is the attribute you wish to create
  	# 			with any valid list and request qualifiers.
  	#  	<op>: 		Is any assignment operator (=, :=, +=, -=).
  	#  	<value>:	Is the value to parse into the new valuepair.
  	# 			If the value is wrapped in double quotes it
  	#			will be xlat expanded.
  #	valuepair_attribute = 'radiusAttribute'
  
negative.code: 	# 			If the attribute name is wrapped in double
  	# 			quotes it will be xlat expanded.
  	#
  	#  Request and list qualifiers may be placed after the 'update'
  	#  section name to set default destination requests/lists
  	#  for <fr attr>s with no list qualifiers.
  	#
  	#  Note: LDAP attribute names should be single quoted unless you want
  	#  the name to be derived from an xlat expansion, or an attribute ref.
  	#
  	update {
  		control:Password-With-Header	+= 'userPassword'
  #		control:NT-Password		:= 'ntPassword'
  