works with ldap correctly