anchor.diff:  <1> The user's group memberships are listed as attributes on the user, and the
   group does not exist as an entry on the server. The `*testMemberOf*` attribute
   cannot be a literal attribute on the user; it can be created during search and
  -returned to the client but not committed to the database.
  +returned to the client, but not committed to the database.
   ====
   
   To sync this group, you must first create the configuration file. The
  
positive.code: - jane.smith@example.com
  - jim.adams@example.com
  ----
  <1> The users that are members of the Group, named as specified by the sync file,
  absent any members for which lookup encountered errors that were tolerated.
  ====
  
  [[sync-ldap-active-directory]]
  
negative.code: [[rfc2307-with-error-tolerances]]
  === RFC 2307 with User-Defined Error Tolerances
  
  By default, if the groups being synced contain members whose entries are outside
  of the scope defined in the member query, the group sync fails with an error:
  
  ----
  Error determining LDAP group membership for "<group>": membership lookup for user "<user>" in group "<group>" failed because of "search for entry with dn="<user-dn>" would search outside of the base dn specified (dn="<base-dn>")".
  ----
  
  This often indicates a mis-configured `baseDN` in the `usersQuery` field.
  However, in cases where the `baseDN` intentionally does not contain some of the
  members of the group, setting `tolerateMemberOutOfScopeErrors: true` allows
  the group sync to continue. Out of scope members will be ignored.
  
  Similarly, when the group sync process fails to locate a member for a group, it
  fails outright with errors:
  
  ----
  Error determining LDAP group membership for "<group>": membership lookup for user "<user>" in group "<group>" failed because of "search for entry with base dn="<user-dn>" refers to a non-existent entry".
  