drop overrids - LDAP has it on its own