We should warn, or die, if when migrating users using migrate-ds we don't get userPassword attributes. This is probably due to the binddn not having read access to this on the remote server.

We may need a flag, --no-password, to allow not having passwords. For someone migrating a bunch of users it would be sad to get to the end only to find out that there are no passwords.

Or perhaps we could add a migrate-check command to sift through and find possible migration errors, or add a --test mode flag.