Relaxed constraints on ldap criteria