Blacklists of simple values in LDAP attribute constraints overlay?