anchor.diff:  
   |_role definition_|
   
  -The role definition may be missing or invalid.
  +The role definition might be missing or invalid.
   
   |======================
   
  -To help track down these possibilities, add the following lines to the end of the `log4j2.properties` configuration file in the
  -`CONFIG_DIR`:
  +To help track down these possibilities, add the following lines to the end of
  +the `log4j2.properties` configuration file in the `CONFIG_DIR`:
   
   [source,properties]
   ----------------
  
positive.code: [[security-troubleshooting]]
  == {security} Troubleshooting
  
  [float]
  === `settings`
  
  Some settings are not returned via the nodes settings API::
  +
  --
  This is intentional. Some of the settings are considered to be highly
  sensitive: all `ssl` settings, ldap `bind_dn`, `bind_password`).
  For this reason, we filter these  settings and do not expose them via
  the nodes info API rest endpoint. You can also define additional
  sensitive settings that should be hidden  using the
  `xpack.security.hide_settings` setting. For example, this snippet
  hides the `url` settings of the `ldap1` realm and all settings of the
  `ad1` realm.
  
  [source, yaml]
  ------------------------------------------
  xpack.security.hide_settings: xpack.security.authc.realms.ldap1.url, xpack.security.authc.realms.ad1.*
  ------------------------------------------
  
  --
  
  [float]
  === `users`
  
  I configured the appropriate roles and the users, but I still get an authorization exception::
  +
  --
  Verify that the role names associated with the users match the roles defined in the `roles.yml` file. You
  can use the `users` tool to list all the users. Any unknown roles are marked with `*`.
  
  [source, shell]
  ------------------------------------------
  bin/xpack/users list
  
negative.code: jacknich       : monitoring,unknown_role* <1>
  ------------------------------------------
  <1> `unknown_role` was not found in `roles.yml`
  
  For more information about this command, see
  {ref}/users-command.html[Users Command].
  --
  
  . If you are authenticating to LDAP, a number of configuration options can cause
  this error.
  +
  --
  |======================
  |_group identification_ |
  
  