That is because it searches for an attribute with name dn and type StringProperty, while the actual type is LargeStringProperty. As a result, e.g. the authenticator never finds the users by their DN, and might create duplicate accounts if the check by uid fails. |