change to allow gitlab to bind as different dn, will probably break things
elsewhere...