s4:provision: use extended_dn_out_ldb or extended_dn_out_dereference depending on...