Working returns SearchResEntry, broken returns SearchResDone; SRD doesn’t work - nss/pam doesn’t rebind w/ supplied creds like SRE Why not?