s3:idmap_ldap: filter out of range mappings in default idmap config