r1381: fixing behavior found by gd@sernet.de; we must use the userPrincipalName value...