anchor.diff:  --
   By default, `ldap_dn` and `ldap_groups` are populated in the user's metadata. 
   For more information, see 
  -{xpack-ref}/ldap-realm.html#ldap-user-metadata[User Metadata in LDAP Realms]. 
  +{stack-ov}/ldap-realm.html#ldap-user-metadata[User Metadata in LDAP Realms]. 
   
   The example below includes the user's common name (`cn`) as an additional
   field in their metadata.
  
positive.code: <3> The LDAP distinguished name (DN) of the `users` group.
  
  For more information, see 
  {xpack-ref}/ldap-realm.html#mapping-roles-ldap[Mapping LDAP Groups to Roles] 
  and 
  {xpack-ref}/mapping-roles.html[Mapping Users and Groups to Roles].
  
  NOTE: The LDAP realm supports
  {stack-ov}/realm-chains.html#authorization_realms[authorization realms] as an
  
negative.code: 
  --
  
  . (Optional) Configure how the {security-features} interact with multiple LDAP
  servers. 
  + 
  --
  The `load_balance.type` setting can be used at the realm level. The {es}
  {security-features} support both failover and load balancing modes of operation.
  See <<ref-ldap-settings>>.
  --
  
  . (Optional) To protect passwords, 
  