OpenLDAP backend: The 'deref' overlay works better as a global