<replaceable>prefix</replaceable> <replaceable>username</replaceable> <replaceable>suffix</replaceable>.
    Typically, the <replaceable>prefix</replaceable> parameter is used to specify
    <literal>cn=</literal>, or <replaceable>DOMAIN</replaceable><literal>\</literal> in an Active
    Directory environment.  <replaceable>suffix</replaceable> is used to specify the
    remaining part of the DN in a non-Active Directory environment.
   </para>

   <para>
    In the second mode, which we will call the search+bind mode,
    the server first binds to the LDAP directory with
    a fixed user name and password, specified with <replaceable>ldapbinddn</replaceable>
    and <replaceable>ldapbindpasswd</replaceable>, and performs a search for the user trying
    to log in to the database. If no user and password is configured, an
    anonymous bind will be attempted to the directory. The search will be
    performed over the subtree at <replaceable>ldapbasedn</replaceable>, and will try to
    do an exact match of the attribute specified in
    <replaceable>ldapsearchattribute</replaceable>.
    Once the user has been found in
    this search, the server re-binds to the directory as
    this user, using the password specified by the client, to verify that the
    login is correct. This mode is the same as that used by LDAP authentication
    schemes in other software, such as Apache <literal>mod_authnz_ldap</literal> and <literal>pam_ldap</literal>.
    This method allows for significantly more flexibility
    in where the user objects are located in the directory, but will cause
    two additional requests to the LDAP server to be made.
   </para>

   <para>
    The following configuration options are used in both modes:
    <variablelist>
     <varlistentry>
      <term><literal>ldapserver</literal></term>
      <listitem>
       <para>
        Names or IP addresses of LDAP servers to connect to. Multiple
        servers may be specified, separated by spaces.
       </para>
      </listitem>
     </varlistentry>
     <varlistentry>
      <term><literal>ldapport</literal></term>
      <listitem>
       <para>
        Port number on LDAP server to connect to. If no port is specified,
        the LDAP library's default port setting will be used.
       </para>
      </listitem>
     </varlistentry>
     <varlistentry>
      <term><literal>ldapscheme</literal></term>
      <listitem>
       <para>
        Set to <literal>ldaps</literal> to use LDAPS.  This is a non-standard
        way of using LDAP over SSL, supported by some LDAP server
        implementations.  See also the <literal>ldaptls</literal> option for
        an alternative.
       </para>
      </listitem>
     </varlistentry>
     <varlistentry>
      <term><literal>ldaptls</literal></term>
      <listitem>
       <para>
        Set to 1 to make the connection between PostgreSQL and the LDAP server
        use TLS encryption.  This uses the <literal>StartTLS</literal>
        operation per <ulink url="https://datatracker.ietf.org/doc/html/rfc4513">RFC 4513</ulink>.
        See also the <literal>ldapscheme</literal> option for an alternative.
       </para>
      </listitem>
     </varlistentry>
    </variablelist>
   </para>

   <para>
    Note that using <literal>ldapscheme</literal> or
    <literal>ldaptls</literal> only encrypts the traffic between the
    PostgreSQL server and the LDAP server.  The connection between the
    PostgreSQL server and the PostgreSQL client will still be unencrypted
    unless SSL is used there as well.
   </para>

   <para>
    The following options are used in simple bind mode only:
    <variablelist>
     <varlistentry>
      <term><literal>ldapprefix</literal></term>
      <listitem>
       <para>
        String to prepend to the user name when forming the DN to bind as,
        when doing simple bind authentication.
       </para>
      </listitem>
     </varlistentry>
     <varlistentry>
      <term><literal>ldapsuffix</literal></term>