no need to check for ldap_dn