The CoLdapProvisionerTargetsController does not define $edit_contains, and so when the edit action is invoked the StandardController reverts to using a $model->read() call, and that does not "do" any contain, and so all CoLdapProvisionerDn rows are being returned, which is a problem for large deployments.