make ldap config sane and don't break cs11 compatibility