priorize ldapi over ldaps
fix ACLs
add SUSE objects to LDAP
kerberos: use ldapi for communication