given our LDAP is crazy we have to search for aliases in both search bases, so the configuration is now more complex, but at least its DRY.