[Issue 9835] New: LDAP aliases ought to always be dereferenced