This approach doesn't seem idempotent, as you test for one LDAP object, but if it doesn't exist, you add 2 LDAP objects. I'd rather we add them just one by one.