* fix: AD authentication when auth_ad_base_dn is an OU OUs don't have SID, so we can't use them to figure out the domain SID * Only match leading OUs * Actually, might be best to remove everything except the domain components.