puzzling Open LDAP dn errors