(givenName=) requires givenName be defined with null value;
I thought LDAP attributes couldn't have NULL values? Don't
know whether I'm making this up, but...
In principle, it should be based on the syntax of the attribute.
I recall directory strings do not allow empty values, so that
filter obviously evaluates to "undefined". The point is that it
was triggering an assertion in the server ...