Read-only default domain for LDAP (bug 1168726)

A proper fix to the above was also blocked by bug 1117356, so that's
fixed here as well (updates properly return the resulting entities).

Change-Id: I672b90e67545cc1fe65b05ef7f8af5b42ca6afc3
Merge "Read-only default domain for LDAP (bug 1168726)"