even better approach: put the secondary password also in md5 crypt format, and use ldap_md5_crypt.validate in order to remove the secondary password leftovers