ldap server + enforcing mode?