<ldap>
      <!-- LDAP server host and port (default: 389) -->
      <host>chef.2s.lan</host>
      <port>389</port>

      <!-- Use LDAP v3 if possible. If disabled, v2 will be used.
           Encryption options are only available if v3 is enabled. -->
      <!--
      <v3/>
      -->

      <!-- Encryption. If enabled, this will create an encrypted channel
           to the LDAP server using the LDAP STARTTLS mechanism. -->
      <!--
      <starttls/>
      -->

      <!-- Encryption. If enabled, this will create an encrypted channel
           to the server using the old-style "ldaps://" mechanism. It is
           recommended that you use <starttls/> instead of this. -->
      <!--
      <ssl/>
      -->

      <!-- DN to bind as for searches. If unspecified, the searches
           will be done anonymously. -->
      <!--
      <binddn>CN=Donald Richardson,OU=staff,DC=2s,DC=lan</binddn>
      <bindpw>mypass</bindpw>
      -->

      <!-- LDAP attribute that holds the user ID (default: uid) -->
      <uidattr>sAMAccountName</uidattr>

      <!-- base DN of the tree. You should specify a DN for each
           authentication realm declared in the <local/> section above,
           by using the realm attribute. -->
      <basedn>DC=2S,DC=lan</basedn>
    </ldap>