posix: allow authenticating anywhere under the base_dn (v2)

v2:
- attempt to fix test failures