Document 'ldap group suffix', better documentation for 'ldap user suffix'