in #140 we had to remove verification against the berkeleyEduAffiliation LDAP attribute because anonymous access was going away. Now, we've received a privileged bind to access the attribute again, so we should re-add support for verifying member affiliations with the privileged bind.
