anchor.diff:  directory tree, but you can also specify a subtree in the directory.
   <2> The scope of the search. Valid values are `base`, `one`, or `sub`. If this
   is left undefined, then a scope of `sub` is assumed. Descriptions of the scope
  -options can be found in the
  -link:../admin_guide/syncing_groups_with_ldap.html#ldap-search[table below].
  +options can be found in the link:#ldap-search[table below].
   <3> The behavior of the search with respect to aliases in the LDAP tree. Valid
   values are `never`, `search`, `base`, or `always`. If this is left undefined,
   then the default is to `always` dereference aliases. Descriptions of the
  -dereferencing behaviors can be found in the
  -link:../admin_guide/syncing_groups_with_ldap.html#deref-aliases[table below].
  +dereferencing behaviors can be found in the link:#deref-aliases[table below].
   <4> The time limit allowed for the search by the client, in seconds. A value of
   0 imposes no client-side limit.
   <5> A valid LDAP search filter. If this is left undefined, then the default is
  
positive.code: testMemberOf: admins
  ----
  <1> The user's group memberships are listed as attributes on the user, and the
  group does not exist as an entry on the server. The `testMemberOf` attribute
  cannot be a literal attribute on the user; it can be created during search and
  returned to the client but not committed to the database.
  ====
  
negative.code: .^|`always`             | Always dereference all aliases found in the LDAP tree.
  |===
  
  [[user-defined-name-mapping]]
  === User-Defined Name Mapping
  
  A user-defined name mapping explicitly maps the names of OpenShift groups to
  unique identifiers that find groups on your LDAP server. The mapping uses normal
  YAML syntax. A user-defined mapping can contain an entry for every group in your
  