Start using the new 'deref' overlay to get extended DNs from OpenLDAP