local_gid_to_sid() could use pdb_ldap, which for now requires ROOT.