posix: allow authenticating anywhere under the base_dn