cross DIT/TLD rootdn - or allow a foreign rootdn