<listitem>
    <para>
        An optional base DN, search scope and LDAP filter
        to restrict LDAP searches for this attribute type.
    </para>
    <para>
        syntax:
<programlisting>
search_base[?scope?[filter][?search_base?scope?[filter]]*]
</programlisting>
    </para>
    <para>
        The scope can be one of "base", "onelevel" or "subtree". The
        scope functions as specified in section 4.5.1.2 of
        http://tools.ietf.org/html/rfc4511
    </para>
    <para>
        The filter must be a valid LDAP search
        filter as specified by
        http://www.ietf.org/rfc/rfc2254.txt
    </para>
    <para>
        For examples of this syntax, please refer to the
        <quote>ldap_search_base</quote> examples section.
    </para>
    <para>
        Default: the value of
        <emphasis>ldap_search_base</emphasis>
    </para>
    <para>
        Please note that specifying scope or filter is not supported for
        searches against an Active Directory Server that might yield a
        large number of results and trigger the Range Retrieval extension
        in the response.
    </para>
</listitem>
