anchor.diff:  timeout: 0 <4>
   filter: (objectClass=intOrgPerson) <5>
   ----
  -<1> The DN of the branch of the directory where all searches should start from. At the very least,
  -this must be the top of your directory tree, but it could also specify a subtree in the directory.
  -<2> The scope of the search. Can be either either `base`, `one` or `sub`. If the scope is not
  -provided, the default is to use a scope of `sub`. Descriptions of the scope options are given in the
  -link:#ldap-search[appendix.]
  -<3> The behavior of the search with respect to aliases in the LDAP tree. Can be either `never`,
  -`search`, `base` or `always`. If the behavior is not given, the default is to `always` dereference
  -aliases. Descriptions of the dereferencing behaviors are given in the
  -link:#deref-aliases[appendix].
  -<4> The time limit allowed for the search by the client, in seconds. A value of 0 imposes no client-
  - side limit.
  -<5> A valid LDAP search filter. If not provided, defaults to `(objectClass=*)`.
  -====
  -
  -A user-defined name mapping explicitly maps names of OpenShift Groups to unique identidiers used to
  -find groups on your LDAP server. Normal `yaml` syntax is used to denote the mapping. A user-defined
  -mapping can contain an entry for every group in your LDAP server or only a subset of those groups.
  -If there are groups on the LDAP server that do not have a user-defined name mapping, the default
  -behavior of the sync job is to use the attribute specified as the group's name.
  +<1> The distinguished name (DN) of the branch of the directory where all
  +searches will start from. It is required that you specify the top of your
  +directory tree, but you can also specify a subtree in the directory.
  +<2> The scope of the search. Valid values are `base`, `one`, or `sub`. If this
  +is left undefined, then a scope of `sub` is assumed. Descriptions of the scope
  +options can be found in the
  +link:../admin_guide/syncing_groups_with_ldap.html#ldap-search[table below].
  +<3> The behavior of the search with respect to aliases in the LDAP tree. Valid
  +values are `never`, `search`, `base`, or `always`. If this is left undefined,
  +then the default is to `always` dereference aliases. Descriptions of the
  +dereferencing behaviors can be found in the
  +link:../admin_guide/syncing_groups_with_ldap.html#deref-aliases[table below].
  +<4> The time limit allowed for the search by the client, in seconds. A value of
  +0 imposes no client-side limit.
  +<5> A valid LDAP search filter. If this is left undefined, then the default is
  +`(objectClass=*)`.
  +====
  +
  +[[ldap-search]]
  +.LDAP Search Scope Options
  +[cols="2a,8a",options="header"]
  +|===
  +|LDAP Search Scope | Description
  +.^|`base`          | Only consider the object at specified by the base DN given for the query.
  +.^|`one`           | Consider all of the objects on the same level in the tree as the base DN for
  +the query.
  +.^|`sub`           | Consider the entire subtree rooted at the base DN given for the query.
  +|===
  +
  +[[deref-aliases]]
  +.LDAP Dereferencing Behaviors
  +[cols="2a,8a",options="header"]
  +|===
  +|Dereferencing Behavior | Description
  +.^|`never`              | Never dereference any aliases found in the LDAP tree.
  +.^|`search`             | Only dereference aliases found while searching.
  +.^|`base`               | Only dereference aliases while finding the base object.
  +.^|`always`             | Always dereference all aliases found in the LDAP tree.
  +|===
  +
  +=== User-Defined Name Mapping
  +A user-defined name mapping explicitly maps the names of OpenShift groups to
  +unique identifiers that find groups on your LDAP server. The mapping uses normal
  +YAML syntax. A user-defined mapping can contain an entry for every group in your
  +LDAP server or only a subset of those groups. If there are groups on the LDAP
  +server that do not have a user-defined name mapping, the default behavior during
  +sync is to use the attribute specified as the group's name.
   
   .User-Defined Name Mapping
   ====
  
positive.code: insecure: true
  activeDirectory:
      usersQuery:
          baseDN: "ou=people,dc=example,dc=com"
          scope: sub
          derefAliases: never
          filter: (objectclass=inetOrgPerson)
      userNameAttributes: [ mail ] <1>
      groupMembershipAttributes: [ memberOf ] <2>
  ----
  <1> The attribute that will be used as the name of the user in the OpenShift group record.
  <2> The attribute on the user that stores the membership information.
  ====
  
  In order to run this sync job, use the following command:
  ----
  $ openshift ex sync-groups --sync-config=active_directory_config.yaml --confirm
  ----
  
  The group record that will be created in OpenShift as a result will look like:
  
  .OpenShift Group Created Using `active_directory_config.yaml`
  ====
  [source,yaml]
  ----
  
negative.code: ----
  ====
  
  == Running LDAP Sync
  Once you've created a
  link:../admin_guide/syncing_groups_with_ldap.html#configuring-ldap-sync[sync configuration file],
  then sync can begin. OpenShift allows administrators to perform a
  number of different sync types with the same server.
  
  [NOTE]
  ====
  By default, all group sync operations are dry-run, so you must set
  the `--confirm` flag on the `sync-groups` command in order to make changes to
  OpenShift Group records.
  ====
  
  To sync all groups from the LDAP server with OpenShift:
  ----
  $ openshift ex sync-groups --sync-config=config.yaml --confirm
  ----
  
  To sync all groups already in OpenShift that correspond to the LDAP
  server specified in the configuration file:
  ----
  $ openshift ex sync-groups --type=openshift --sync-config=config.yaml --confirm
  ----
  
  To sync a subset of LDAP groups with Openshift you can use whitelist
  files, blacklist files, or both:
  
  [NOTE]
  ====
  Any combination of blacklist files, whitelist files, or whitelist literals will
  work; whitelist literals can be included directly in the command itself. This
  applies to groups found on LDAP servers, as well as groups already present in
  OpenShift. Your files must contain one unique group identifier per line.
  ====
  
  ----
  $ openshift ex sync-groups --whitelist=whitelist.txt --sync-config=config.yaml --confirm
  $ openshift ex sync-groups --blacklist=blacklist.txt --sync-config=config.yaml --confirm
  