base_dn defaults to a zero length string to allow top of tree searching like in >= 2.2.3