this must not be removed, otherwise openLDAP will blow up in our faces