added a deref option to ldap store configuration since MS AD doesnt like ldap deref