ah yes, there's an explicit check for lldap_admin