s4-s3upgrade: Force ldapsam:trusted = yes