anchor.diff:  <3> The LDAP distinguished name (DN) of the `users` group.
   
   For more information, see 
  -{xpack-ref}/ldap-realm.html#mapping-roles-ldap[Mapping LDAP Groups to Roles] 
  +{stack-ov}/ldap-realm.html#mapping-roles-ldap[Mapping LDAP Groups to Roles] 
   and 
  -{xpack-ref}/mapping-roles.html[Mapping Users and Groups to Roles].
  +{stack-ov}/mapping-roles.html[Mapping Users and Groups to Roles].
   
   NOTE: The LDAP realm supports
   {stack-ov}/realm-chains.html#authorization_realms[authorization realms] as an
  
positive.code: --
  By default, `ldap_dn` and `ldap_groups` are populated in the user's metadata. 
  For more information, see 
  {xpack-ref}/ldap-realm.html#ldap-user-metadata[User Metadata in LDAP Realms]. 
  
  The example below includes the user's common name (`cn`) as an additional
  field in their metadata.
  
negative.code:             bind_dn: "cn=ldapuser, ou=users, o=services, dc=example, dc=com"
              user_search:
                base_dn: "dc=example,dc=com"
                filter: "(cn={0})"
              group_search:
                base_dn: "dc=example,dc=com"
              files:
  