anchor.diff:  
   `cache.max_users`:: The maximum number of user entries that can live in the
   cache at any given time. Defaults to 100,000.
  +
  +`authorization_realms`::
  +The names of the realms that should be consulted for delegated authorization.
  +If this setting is used, then the Kerberos realm does not perform role mapping and
  +instead loads the user from the listed realms.
  +See {stack-ov}/realm-chains.html#authorization_realms[Delegating authorization to another realm]
   
   [float]
   [[load-balancing]]
  
positive.code: Defaults to `ES_PATH_CONF/role_mapping.yml`.
  
  `authorization_realms`::
  The names of the realms that should be consulted for delegate authorization.
  If this setting is used, then the PKI realm does not perform role mapping and
  instead loads the user from the listed realms.
  See {stack-ov}/realm-chains.html#authorization_realms[Delegating authorization to another realm] 
  
negative.code: provided by the SAML attributes. Defaults to `true`.
  
  `authorization_realms`::
  The names of the realms that should be consulted for delegated authorization.
  If this setting is used, then the SAML realm does not perform role mapping and
  instead loads the user from the listed realms.
  See {stack-ov}/realm-chains.html#authorization_realms[Delegating authorization to another realm] 
  