diff --git a/README.rst b/README.rst
index 0ec9620..ab7a965 100644
--- a/README.rst
+++ b/README.rst
@@ -199,6 +199,22 @@
         ...
 
 Keystone domain with LDAP backend, using SQL for
+role/project assignment and disabled group mapping block:
+
+.. code-block:: yaml
+
+    keystone:
+      server:
+        domain:
+          external:
+            description: "Testing domain"
+            backend: ldap
+            assignment:
+              backend: sql
+            ldap:
+              group_mapping: False
+
+Keystone domain with LDAP backend, using SQL for
 role/project assignment:
 
 .. code-block:: yaml
@@ -212,11 +228,24 @@
             assignment:
               backend: sql
             ldap:
+              group_mapping: False
               url: "ldaps://idm.domain.com"
               suffix: "dc=cloud,dc=domain,dc=com"
               # Will bind as uid=keystone,cn=users,cn=accounts,dc=cloud,dc=domain,dc=com
               uid: keystone
               password: password
+              query_scope: "sub"
+              bind_user: "CN=lab,CN=users,${keystone:server:domain:testing:ldap:suffix}"
+              filter:
+                user: "(memberOf=CN=Grp-atm-admins,CN=Users,${keystone:server:domain:testing:ldap:suffix})"
+              user_tree_dn: "CN=users,${keystone:server:domain:testing:ldap:suffix}"
+              user_id_attribute: "sAMAccountName"
+              user_name_attribute: "sAMAccountName"
+              user_pass_attribute: ""
+              user_enabled_default: 512
+              user_enabled_mask: 2
+              user_enabled_attribute: "userAccountControl"
+              user_attribute_ignore: "password,tenant_id,tenants"
 
 Use driver aliases for drivers instead of class path's:
 
diff --git a/keystone/files/_ldap.conf b/keystone/files/_ldap.conf
index 595ccd1..56c89ae 100644
--- a/keystone/files/_ldap.conf
+++ b/keystone/files/_ldap.conf
@@ -2,11 +2,11 @@
 [ldap]
 url = {{ ldap.url }}
 {%- if ldap.get('auth', True) == True %}
-{%- if ldap.bind_user is defined %}
+  {%- if ldap.bind_user is defined %}
 user = {{ ldap.bind_user }}
-{%- else %}
+  {%- else %}
 user = uid={{ ldap.get("uid", "keystone") }},cn=users,cn=accounts,{{ ldap.suffix }}
-{%- endif %}
+  {%- endif %}
 password = {{ ldap.password }}
 {%- endif %}
 suffix = {{ ldap.suffix }}
@@ -34,6 +34,9 @@
 user_enabled_default = {{ ldap.get("user_enabled_default", False) }}
 user_enabled_invert = {{ ldap.get("user_enabled_invert", True) }}
 user_enabled_mask = {{ ldap.get("user_enabled_mask", 0) }}
+{%- if ldap.user_attribute_ignore is defined %}
+user_attribute_ignore = {{ ldap.user_attribute_ignore }}
+{%- endif %}
 {%- if ldap.get('filter', {}).get('user', False) %}
 user_filter = {{ ldap.filter.user }}
 {%- endif %}
@@ -47,47 +50,49 @@
 user_enabled_emulation_use_group_config = {{ ldap.user_enabled_emulation_use_group_config }}
 {%- endif %}
 
+{%- if ldap.get('group_mapping', True) %}
 # Group mapping
-{%- if ldap.group_tree_dn is defined  %}
+  {%- if ldap.group_tree_dn is defined %}
 group_tree_dn = {{ ldap.group_tree_dn }}
-{%- else %}
+  {%- else %}
 group_tree_dn = cn=groups,cn=accounts,{{ ldap.suffix }}
-{%- endif %}
+  {%- endif %}
 group_objectclass = {{ ldap.get("group_objectclass", "groupOfNames") }}
 group_id_attribute = {{ ldap.get("group_id_attribute", "cn") }}
 group_name_attribute = {{ ldap.get("group_name_attribute", "cn") }}
 group_member_attribute = {{ ldap.get("group_member_attribute", "member") }}
 group_desc_attribute = {{ ldap.get("group_desc_attribute", "description") }}
-{%- if ldap.get('read_only', True) %}
+  {%- if ldap.get('read_only', True) %}
 group_allow_create = false
 group_allow_update = false
 group_allow_delete = false
-{%- endif %}
-{%- if ldap.get('filter', {}).get('group', False) %}
+  {%- endif %}
+  {%- if ldap.get('filter', {}).get('group', False) %}
 group_filter = {{ ldap.filter.group }}
-{%- endif %}
-{%- if ldap.group_members_are_ids is defined  %}
+  {%- endif %}
+  {%- if ldap.group_members_are_ids is defined  %}
 group_members_are_ids = {{ ldap.group_members_are_ids }}
+  {%- endif %}
 {%- endif %}
 
 {%- if ldap.tls is defined %}
 
-{%- if ldap.tls.get("enabled", False) %}
+  {%- if ldap.tls.get("enabled", False) %}
 use_tls = true
-{%- endif %}
+  {%- endif %}
 
-{%- if ldap.tls.cacertdir is defined %}
+  {%- if ldap.tls.cacertdir is defined %}
 tls_cacertdir = {{ ldap.tls.cacertdir }}
-{%- endif %}
+  {%- endif %}
 
-{%- if ldap.tls.cacert is defined %}
+  {%- if ldap.tls.cacert is defined %}
 tls_cacertfile = /etc/keystone/domains/{{ domain_name }}.pem
-{%- elif ldap.tls.cacertfile is defined %}
+  {%- elif ldap.tls.cacertfile is defined %}
 tls_cacertfile = {{ ldap.tls.cacertfile }}
-{%- endif %}
+  {%- endif %}
 
-{%- if ldap.tls.req_cert is defined %}
+  {%- if ldap.tls.req_cert is defined %}
 tls_req_cert = {{ ldap.tls.req_cert }}
-{%- endif %}
+  {%- endif %}
 
 {%- endif %}
diff --git a/tests/pillar/single.sls b/tests/pillar/single.sls
index 697e40e..ba1ef77 100644
--- a/tests/pillar/single.sls
+++ b/tests/pillar/single.sls
@@ -185,10 +185,24 @@
           backend: sql
           driver: keystone.assignment.backends.sql.Assignment
         ldap:
+          group_mapping: False
           url: "ldaps://idm.domain.com"
           suffix: "dc=cloud,dc=domain,dc=com"
           uid: keystone
           password: password
+          query_scope: "sub"
+          bind_user: "CN=lab,CN=users,${keystone:server:domain:testing:ldap:suffix}"
+          filter:
+            user: "(memberOf=CN=Grp-atm-admins,CN=Users,${keystone:server:domain:testing:ldap:suffix})"
+          user_tree_dn: "CN=users,${keystone:server:domain:testing:ldap:suffix}"
+          user_id_attribute: "sAMAccountName"
+          user_name_attribute: "sAMAccountName"
+          user_pass_attribute: ""
+          user_enabled_default: 512
+          user_enabled_mask: 2
+          user_enabled_attribute: "userAccountControl"
+          user_attribute_ignore: "password,tenant_id,tenants"
+
 # Client state
   client:
     enabled: false