The only configuration option currently includes root_dn, not allowing the use of kolab_wap.hosted_root_dn for, for example, active and suspended roles.
This has previously caused both domain and root_dn to be set to the hosted domain, resulting in the inverse -- cn=admin-user,%(kolab_wap.mgmt_root_dn) does not become available.