This attribute defines the scope to be used to find entries for roles. The scope must be one of the following:
SCOPE_BASE
SCOPE_ONE
SCOPE_SUB (default)