Sorry, sent too early.

It makes sense if you add a config parameter with an LDAP URL or something describing entries which can be so modified (subject to ordinary access controls).

I imagine one would typically filter for objectClass, e.g. ldap:///???(objectClass=person)