anchor.diff:  ----
   kind: LDAPSyncConfig
   apiVersion: v1
  +url: ldap://LDAP_SERVICE_IP:389 <1>
  +insecure: true <2>
   rfc2307:
       groupsQuery:
  -        baseDN: "ou=groups,ou=rfc2307,dc=example,dc=com"
  +        baseDN: "ou=groups,dc=example,dc=com"
           scope: sub
           derefAliases: never
           filter: (objectclass=groupOfNames)
  -    groupUIDAttribute: dn <1>
  -    groupNameAttributes: [ cn ] <2>
  -    groupMembershipAttributes: [ member ] <3>
  +    groupUIDAttribute: dn <3>
  +    groupNameAttributes: [ cn ] <4>
  +    groupMembershipAttributes: [ member ] <5>
       usersQuery:
  -        baseDN: "ou=people,ou=rfc2307,dc=example,dc=com"
  +        baseDN: "ou=users,dc=example,dc=com"
           scope: sub
           derefAliases: never
           filter: (objectclass=inetOrgPerson)
  -    userUIDAttribute: dn <4>
  -    userNameAttributes: [ mail ] <5>
  -----
  -<1> The attribute used to uniquely identify a group on the LDAP server.
  -<2> The attribute that will be used as the name of the group.
  -<3> The attribute on the group that stores the membership information.
  -<4> The attribute used to uniquely identify a user on the LDAP server.
  -<5> The attribute that will be used as the name of the user in the OpenShift group record.
  -====
  -
  -In order to run this sync job, use the following command:
  +    userUIDAttribute: dn <6>
  +    userNameAttributes: [ mail ] <7>
  +----
  +<1> The IP address and host of the LDAP server where this group's record is
  +stored.
  +<2> When `true`, no TLS connection is made to the server. When `false`, secure
  +LDAP (`ldaps://`) URLs connect using TLS, and insecure LDAP (`ldap://`) URLs are
  +upgraded to TLS.
  +<3> The attribute that uniquely identifies a group on the LDAP server.
  +<4> The attribute to use as the name of the group.
  +<5> The attribute on the group that stores the membership information.
  +<6> The attribute that uniquely identifies a user on the LDAP server.
  +<7> The attribute to use as the name of the user in the OpenShift group record.
  +====
  +
  +To run sync with the `rfc2307_config.yaml` file:
   ----
   $ openshift ex sync-groups --sync-config=rfc2307_config.yaml --confirm
   ----
   
  -The group record that will be created in OpenShift as a result will look like:
  +The group record that OpenShift creates as a result of the above sync
  +operation:
   
   .OpenShift Group Created Using `rfc2307_config.yaml`
   ====
  
positive.code:   "cn=admins,ou=groups,dc=example,dc=com": Administrators <1>
  rfc2307:
      groupsQuery:
          baseDN: "ou=groups,ou=rfc2307,dc=example,dc=com"
          scope: sub
          derefAliases: never
          filter: (objectclass=groupOfNames)
  
negative.code: timeout: 0 <4>
  filter: (objectClass=intOrgPerson) <5>
  ----
  <1> The distinguished name (DN) of the branch of the directory where all
  searches will start from. It is required that you specify the top of your
  directory tree, but you can also specify a subtree in the directory.
  <2> The scope of the search. Valid values are `base`, `one`, or `sub`. If this
  is left undefined, then a scope of `sub` is assumed. Descriptions of the scope
  options can be found in the
  link:../admin_guide/syncing_groups_with_ldap.html#ldap-search[table below].
  <3> The behavior of the search with respect to aliases in the LDAP tree. Valid
  values are `never`, `search`, `base`, or `always`. If this is left undefined,
  then the default is to `always` dereference aliases. Descriptions of the
  dereferencing behaviors can be found in the
  link:../admin_guide/syncing_groups_with_ldap.html#deref-aliases[table below].
  <4> The time limit allowed for the search by the client, in seconds. A value of
  0 imposes no client-side limit.
  <5> A valid LDAP search filter. If this is left undefined, then the default is
  `(objectClass=*)`.
  ====
  
  [[ldap-search]]
  .LDAP Search Scope Options
  [cols="2a,8a",options="header"]
  |===
  |LDAP Search Scope | Description
  .^|`base`          | Only consider the object at specified by the base DN given for the query.
  .^|`one`           | Consider all of the objects on the same level in the tree as the base DN for
  the query.
  .^|`sub`           | Consider the entire subtree rooted at the base DN given for the query.
  |===
  
  [[deref-aliases]]
  .LDAP Dereferencing Behaviors
  [cols="2a,8a",options="header"]
  |===
  |Dereferencing Behavior | Description
  .^|`never`              | Never dereference any aliases found in the LDAP tree.
  .^|`search`             | Only dereference aliases found while searching.
  .^|`base`               | Only dereference aliases while finding the base object.
  .^|`always`             | Always dereference all aliases found in the LDAP tree.
  |===
  
  === User-Defined Name Mapping
  A user-defined name mapping explicitly maps the names of OpenShift groups to
  unique identifiers that find groups on your LDAP server. The mapping uses normal
  YAML syntax. A user-defined mapping can contain an entry for every group in your
  LDAP server or only a subset of those groups. If there are groups on the LDAP
  server that do not have a user-defined name mapping, the default behavior during
  sync is to use the attribute specified as the group's name.
  
  .User-Defined Name Mapping
  ====
  