LDAP:  username2dn should only return DNs that belong to the current LDAP server. Might be not perfect. Easy perfect solution would increase communication with LDAP server. Let's see if it is good enough