anchor.diff:  <3> The LDAP distinguished name (DN) of the `users` group.
   
   For more information, see 
  -{xpack-ref}/ldap-realm.html#mapping-roles-ldap[Mapping LDAP Groups to Roles] 
  +{stack-ov}/ldap-realm.html#mapping-roles-ldap[Mapping LDAP Groups to Roles] 
   and 
  -{xpack-ref}/mapping-roles.html[Mapping Users and Groups to Roles].
  +{stack-ov}/mapping-roles.html[Mapping Users and Groups to Roles].
   
   NOTE: The LDAP realm supports
   {stack-ov}/realm-chains.html#authorization_realms[authorization realms] as an
  
positive.code: 
  --
  
  . (Optional) Configure how {security} should interact with multiple LDAP servers. 
  + 
  --
  The `load_balance.type` setting can be used at the realm level. {security} 
  supports both failover and load balancing modes of operation. See 
  <<ref-ldap-settings>>.
  --
  
  . (Optional) To protect passwords, 
  
negative.code:           bind_dn: "cn=ldapuser, ou=users, o=services, dc=example, dc=com"
            user_search:
              base_dn: "dc=example,dc=com"
              filter: "(cn={0})"
            group_search:
              base_dn: "dc=example,dc=com"
            files:
  