Don't assume we can keep an LDAP client around indefinitely