masking LDAP search responses