authentication via LDAP works in principle
storing (pseudo-)unique identity URL in database
wrong login data is handled
fixed login/logout
allowing to log out on OpenID side