anchor.diff:  insecure: true
   activeDirectory:
       usersQuery:
  -        baseDN: "ou=people,dc=example,dc=com"
  +        baseDN: "ou=users,dc=example,dc=com"
           scope: sub
           derefAliases: never
           filter: (objectclass=inetOrgPerson)
       userNameAttributes: [ mail ] <1>
  -    groupMembershipAttributes: [ memberOf ] <2>
  -----
  -<1> The attribute that will be used as the name of the user in the OpenShift group record.
  +    groupMembershipAttributes: [ testMemberOf ] <2>
  +----
  +<1> The attribute to use as the name of the user in the OpenShift group record.
   <2> The attribute on the user that stores the membership information.
   ====
   
  -In order to run this sync job, use the following command:
  +To run sync with the `active_directory_config.yaml` file:
   ----
   $ openshift ex sync-groups --sync-config=active_directory_config.yaml --confirm
   ----
   
  -The group record that will be created in OpenShift as a result will look like:
  +The group record that OpenShift creates as a result of the above sync
  +operation:
   
   .OpenShift Group Created Using `active_directory_config.yaml`
  +====
  +[source,yaml]
  +----
  +apiVersion: v1
  +kind: Group
  +metadata:
  +  annotations:
  +    openshift.io/ldap.sync-time: 2015-10-13T10:08:38-0400 <1>
  +    openshift.io/ldap.uid: admins <2>
  +    openshift.io/ldap.url: LDAP_SERVER_IP:389 <3>
  +  creationTimestamp:
  +  name: admins <4>
  +users: <5>
  +- jane.smith@example.com
  +- jim.adams@example.com
  +----
  +<1> The last time this group was synchronized with the LDAP server, in ISO 6801
  +format.
  +<2> The unique identifier for the group on the LDAP server.
  +<3> The IP address and host of the LDAP server where this group's record is
  +stored.
  +<4> The name of the group as listed in the LDAP server.
  +<5> The users that are members of the group, named as specified by the
  +sync file.
  +====
  +
  +=== Augmented Active Directory
  +In the augmented Active Directory schema, both users (Jane and Jim) and groups
  +exist in the LDAP server as first-class entries, and group membership is stored
  +in attributes on the user. The following snippet of `ldif` defines the users and
  +group for this schema:
  +
  +.LDAP Entries Using Augmented Active Directory Schema: `augmented_active_directory.ldif`
  +====
  +[source,ldif]
  +----
  +dn: ou=users,dc=example,dc=com
  +objectClass: organizationalUnit
  +ou: users
  +
  +dn: cn=Jane,ou=users,dc=example,dc=com
  +objectClass: person
  +objectClass: organizationalPerson
  +objectClass: inetOrgPerson
  +objectClass: testPerson
  +cn: Jane
  +sn: Smith
  +displayName: Jane Smith
  +mail: jane.smith@example.com
  +testMemberOf: cn=admins,ou=groups,dc=example,dc=com <1>
  +
  +dn: cn=Jim,ou=users,dc=example,dc=com
  +objectClass: person
  +objectClass: organizationalPerson
  +objectClass: inetOrgPerson
  +objectClass: testPerson
  +cn: Jim
  +sn: Adams
  +displayName: Jim Adams
  +mail: jim.adams@example.com
  +testMemberOf: cn=admins,ou=groups,dc=example,dc=com
  +
  +dn: ou=groups,dc=example,dc=com
  +objectClass: organizationalUnit
  +ou: groups
  +
  +dn: cn=admins,ou=groups,dc=example,dc=com <2>
  +objectClass: groupOfNames
  +cn: admins
  +owner: cn=admin,dc=example,dc=com
  +description: System Adminstrators
  +member: cn=Jane,ou=users,dc=example,dc=com
  +member: cn=Jim,ou=users,dc=example,dc=com
  +----
  +<1> The user's group memberships are listed as attributes on the user.
  +<2> The group is a first-class entry on the LDAP server.
  +====
  +
  +To sync this group, you must first create the configuration file. The
  +augmented Active Directory schema requires you to provide an LDAP query
  +definition for both user entries and group entries, as well as the attributes to
  +represent them with in the internal OpenShift records.
  +
  +For clarity, the group you create in OpenShift should use attributes other
  +than the distinguished name whenever possible for user- or administrator-facing
  +fields. For example, identify the users of a group by their e-mail,
  +and use the name of the group as the common name. The following configuration
  +file creates these relationships.
  +
  +.LDAP Sync Configuration Using Augmented Active Directory Schema:  `augmented_active_directory_config.yaml`
  +====
  +[source,yaml]
  +----
  +kind: LDAPSyncConfig
  +apiVersion: v1
  +url: ldap://LDAP_SERVICE_IP:389
  +insecure: true
  +augmentedActiveDirectory:
  +    groupsQuery:
  +        baseDN: "ou=groups,dc=example,dc=com"
  +        scope: sub
  +        derefAliases: never
  +        filter: (objectclass=groupOfNames)
  +    groupUIDAttribute: dn <1>
  +    groupNameAttributes: [ cn ] <2>
  +    usersQuery:
  +        baseDN: "ou=users,dc=example,dc=com"
  +        scope: sub
  +        derefAliases: never
  +        filter: (objectclass=inetOrgPerson)
  +    userNameAttributes: [ mail ] <3>
  +    groupMembershipAttributes: [ testMemberOf ] <4>
  +----
  +<1> The attribute that uniquely identifies a group on the LDAP server.
  +<2> The attribute to use as the name of the group.
  +<3> The attribute to use as the name of the user in the OpenShift group record.
  +<4> The attribute on the user that stores the membership information.
  +====
  +
  +To run sync with the `augmented_active_directory_config.yaml` file:
  +----
  +$ openshift ex sync-groups --sync-config=augmented_active_directory_config.yaml --confirm
  +----
  +
  +The group record that OpenShift creates as a result of the above sync operation:
  +
  +.OpenShift Group Created Using `augmented_active_directory_config.yaml`
   ====
   [source,yaml]
   ----
  
positive.code:     groupNameAttributes: [ cn ] <3>
      groupMembershipAttributes: [ member ]
      usersQuery:
          baseDN: "ou=people,ou=rfc2307,dc=example,dc=com"
          scope: sub
          derefAliases: never
          filter: (objectclass=inetOrgPerson)
      userUIDAttribute: dn
      userNameAttributes: [ mail ]
  ----
  <1> The user-defined name mapping
  <2> The unique identifier attribute that is used for the keys in the user-defined name mapping
  <3> The attribute that will be used to name OpenShift groups if their unique identifier is not in
   the user-defined name mapping
  ====
  
  In order to run this sync job, use the following command:
  ----
  $ openshift ex sync-groups --sync-config=rfc2307_config_user_defined.yaml --confirm
  ----
  
  The group record that will be created in OpenShift as a result will look like:
  
  .OpenShift Group Created Using `rfc2307_config_user_defined.yaml`
  ====
  
negative.code:   member: cn=Jane,ou=users,dc=example,dc=com <2>
    member: cn=Jim,ou=users,dc=example,dc=com
  ----
  <1> The group is a first-class entry in the LDAP server.
  <2> Members of a group are listed with an identifying reference as attributes on
  the group.
  ====
  
  To sync this group, you must first create the configuration file. The
  RFC2307 schema requires you to provide an LDAP query definition for both user
  and group entries, as well as the attributes to represent them with in the
  internal OpenShift records.
  
  For clarity, the group you create in OpenShift should use attributes other than
  the distinguished name whenever possible for user- or administrator-facing
  fields. For example, identify the users of a group by their e-mail, and use the
  name of the group as the common name. The following configuration file creates
  these relationships:
  
  [NOTE]
  ====
  If using user-defined name mappings, your
  link:../admin_guide/syncing_groups_with_ldap.html#rfc2307-with-user-defined-name-mappings[configuration file] will differ.
  ====
  
  .LDAP Sync Configuration Using RFC2307 Schema: `rfc2307_config.yaml`
  ====
  