when synchronizing ldap users, user "realm.ldap.admins" to set the appropriate admin rights