Description of problem:
Documentation bug:  Integrate with Identity Service - Chapter 1. Active Directory Integration 

In section 1.14.1 Test LDAP connections, connections are tested with the "sub" keyword which makes openldap search the whole subtree. However, the configuration for ldap in /etc/keystone/domains/keystone.LAB.conf  is a simple search, so it ignores nested groups. This leads to confusion over the correct usage of keystone AD integration with nested groups.

Please document the following parameter for /etc/keystone/domains/keystone.LAB.conf:

# The LDAP scope for queries, this can be either "one" (onelevel/singleLevel)
# or "sub" (subtree/wholeSubtree). (string value)
#query_scope = one