OpenLDAP and "reverse" wildcards