make sure that shib_auth (which queries ldap to determine the localusername) can update the username for ssh