anchor.diff:      groupNameAttributes: [ cn ] <3>
       groupMembershipAttributes: [ member ]
       usersQuery:
  -        baseDN: "ou=people,ou=rfc2307,dc=example,dc=com"
  +        baseDN: "ou=users,dc=example,dc=com"
           scope: sub
           derefAliases: never
           filter: (objectclass=inetOrgPerson)
       userUIDAttribute: dn
       userNameAttributes: [ mail ]
   ----
  -<1> The user-defined name mapping
  -<2> The unique identifier attribute that is used for the keys in the user-defined name mapping
  -<3> The attribute that will be used to name OpenShift groups if their unique identifier is not in
  - the user-defined name mapping
  -====
  -
  -In order to run this sync job, use the following command:
  +<1> The user-defined name mapping.
  +<2> The unique identifier attribute that is used for the keys in the
  +user-defined name mapping.
  +<3> The attribute to name OpenShift groups with if their unique identifier is not in the user-defined name mapping.
  +====
  +
  +To run sync with the `rfc2307_config_user_defined.yaml` file:
   ----
   $ openshift ex sync-groups --sync-config=rfc2307_config_user_defined.yaml --confirm
   ----
   
  -The group record that will be created in OpenShift as a result will look like:
  +The group record that OpenShift creates as a result of the above sync
  +operation:
   
   .OpenShift Group Created Using `rfc2307_config_user_defined.yaml`
   ====
  
positive.code: insecure: true
  activeDirectory:
      usersQuery:
          baseDN: "ou=people,dc=example,dc=com"
          scope: sub
          derefAliases: never
          filter: (objectclass=inetOrgPerson)
      userNameAttributes: [ mail ] <1>
      groupMembershipAttributes: [ memberOf ] <2>
  ----
  <1> The attribute that will be used as the name of the user in the OpenShift group record.
  <2> The attribute on the user that stores the membership information.
  ====
  
  In order to run this sync job, use the following command:
  ----
  $ openshift ex sync-groups --sync-config=active_directory_config.yaml --confirm
  ----
  
  The group record that will be created in OpenShift as a result will look like:
  
  .OpenShift Group Created Using `active_directory_config.yaml`
  ====
  [source,yaml]
  ----
  
negative.code: toc::[]
  
  == Overview
  As an OpenShift administrator, grouping users allows you to better manage them,
  change their permissions, or to enhance collaboration. Your organization may
  have already created user groups and stored them in an LDAP server. OpenShift
  can sync those LDAP records with internal OpenShift records, allowing you
  to simply manage your groups in one place. OpenShift currently supports group
  sync with LDAP servers using three common schema for defining group
  membership: RFC 2307, Active Directory, and augmented Active Directory.
  
  [NOTE]
  ====
  You must have
  link:../architecture/additional_concepts/authorization.html#roles[*cluster-admin* privileges] to sync groups.
  ====
  
  [[configuring-ldap-sync]]
  == Configuring LDAP Sync
  
  Before you can
  link:../admin_guide/syncing_groups_with_ldap.html#running-ldap-synchronization[run LDAP sync], you need a sync configuration
  file. This file contains LDAP client configuration details, allowing you to:
  
  * Correctly connect to your LDAP server.
  * Sync configuration options that are dependent on the schema used in your LDAP server.
  
  A sync configuration file can also contain an administrator-defined list of name
  mappings, which is useful when deciding which groups in OpenShift to map to the
  groups in your LDAP server.
  
  === LDAP Client Configuration
  
  .LDAP Client Configuration
  ====
  [source,yaml]
  ----
  url: ldap://10.0.0.0:389 <1>
  bindDN: cn=admin,dc=example,dc=com <2>
  bindPassword: password <3>
  insecure: true <4>
  ca: my-ldap-ca-bundle.crt <5>
  ----
  <1> The connection protocol, IP address of the LDAP server hosting your
  database, and the port to connect to, formatted as `scheme://host:port`.
  <2> Optionally, specify a distinguished name (DN) to use as the Bind DN.
  OpenShift uses this if elevated privilege is required to retrieve entries for
  the sync operation.
  <3> Optionally, specify a password to use to bind. OpenShift uses this if
  elevated privilege is necessary to retrieve entries for the sync
  operation.
  <4> When `true`, no TLS connection is made to the server. When `false`, secure
  LDAP (`ldaps://`) URLs connect using TLS, and insecure LDAP (`ldap://`) URLs are
  upgraded to TLS.
  <5> The certificate bundle to use for validating server certificates for the
  configured URL. If empty, OpenShift uses system-trusted roots. This only applies
  if `insecure` is set to `false`.
  ====
  
  === LDAP Query Definition
  Sync configurations consist of LDAP query definitions for the entries that are
  required for synchronization. The specific definition of an LDAP query depends
  on the schema used to store membership information in the LDAP server.
  
  .LDAP Query Definition
  ====
  