got a working read-only keystone backed by openldap