this code does two things - restricts the set of domains we'll support explicitly, AND handles different LDAP search bases.