OpenLDAP provisioning tweaks