anchor.diff:            bind_dn: "cn=ldapuser, ou=users, o=services, dc=example, dc=com"
             user_search:
               base_dn: "dc=example,dc=com"
  -            attribute: cn
  +            filter: "(cn={0})"
             group_search:
               base_dn: "dc=example,dc=com"
             files:
  
positive.code: [[configuring-ldap-realm]]
  === Configuring an LDAP realm
  
  You can configure {security} to communicate with a Lightweight Directory Access
  Protocol (LDAP) server to authenticate users. To integrate with LDAP, you
  configure an `ldap` realm and map LDAP groups to user roles.
  
  For more information about LDAP realms, see 
  {xpack-ref}/ldap-realm.html[LDAP User Authentication].
  
  . Determine which mode you want to use. The `ldap` realm supports two modes of 
  operation, a user search mode and a mode with specific templates for user DNs. 
  
negative.code: 
  --
  
  . (Optional) Configure how the {security-features} interact with multiple LDAP
  servers. 
  + 
  --
  The `load_balance.type` setting can be used at the realm level. The {es}
  {security-features} support both failover and load balancing modes of operation.
  See <<ref-ldap-settings>>.
  --
  
  . (Optional) To protect passwords, 
  