anchor.diff:  directory tree, but you can also specify a subtree in the directory.
   <2> The scope of the search. Valid values are `base`, `one`, or `sub`. If this
   is left undefined, then a scope of `sub` is assumed. Descriptions of the scope
  -options can be found in the
  -link:../admin_guide/syncing_groups_with_ldap.html#ldap-search[table below].
  +options can be found in the link:#ldap-search[table below].
   <3> The behavior of the search with respect to aliases in the LDAP tree. Valid
   values are `never`, `search`, `base`, or `always`. If this is left undefined,
   then the default is to `always` dereference aliases. Descriptions of the
  -dereferencing behaviors can be found in the
  -link:../admin_guide/syncing_groups_with_ldap.html#deref-aliases[table below].
  +dereferencing behaviors can be found in the link:#deref-aliases[table below].
   <4> The time limit allowed for the search by the client, in seconds. A value of
   0 imposes no client-side limit.
   <5> A valid LDAP search filter. If this is left undefined, then the default is
  
positive.code: [NOTE]
  ====
  If using user-defined name mappings, your
  link:../admin_guide/syncing_groups_with_ldap.html#rfc2307-with-user-defined-name-mappings[configuration file] will differ.
  ====
  
  .LDAP Sync Configuration Using RFC2307 Schema: `rfc2307_config.yaml`
  ====
  [source,yaml]
  ----
  
negative.code: testMemberOf: admins
  ----
  <1> The user's group memberships are listed as attributes on the user, and the
  group does not exist as an entry on the server. The `*testMemberOf*` attribute
  cannot be a literal attribute on the user; it can be created during search and
  returned to the client but not committed to the database.
  ====
  