anchor.diff:  <2> When `true`, no TLS connection is made to the server. When `false`, secure
   LDAP (`ldaps://`) URLs connect using TLS, and insecure LDAP (`ldap://`) URLs are
   upgraded to TLS.
  -<3> The attribute that uniquely identifies a group on the LDAP server.
  +<3> The attribute that uniquely identifies a group on the LDAP server. 
  +You cannot specify `groupsQuery` filters when using DN for groupUIDAttribute.
  +For fine-grained filtering, use the 
  +xref:../install_config/syncing_groups_with_ldap.adoc#running-ldap-sync[whitelist / blacklist method].
   <4> The attribute to use as the name of the Group.
   <5> The attribute on the group that stores the membership information.
  -<6> The attribute that uniquely identifies a user on the LDAP server.
  +<6> The attribute that uniquely identifies a user on the LDAP server. You
  +cannot specify `usersQuery` filters when using DN for userUIDAttribute. For
  +fine-grained  filtering, use the 
  +xref:../install_config/syncing_groups_with_ldap.adoc#running-ldap-sync[whitelist / blacklist method].
   <7> The attribute to use as the name of the user in the {product-title} Group record.
   ====
   
  
positive.code: the user scope given in the `usersQuery` base DN, and members outside the member
  query scope are ignored. The default behavior for the sync job is to fail if a
  member of a group is out of scope.
  ====
  
  To run sync with the *_rfc2307_config_tolerating.yaml_* file:
  
negative.code:         baseDN: "ou=users,dc=example,dc=com"
          scope: sub
          derefAliases: never
          pageSize: 0
      userUIDAttribute: dn <6>
      userNameAttributes: [ mail ] <7>
  