ok, danke, da hätte ich auch mal selbst drauf kommen können ;-)
SOLVED
/*
* Allow users with full permissions to open a full shared store on a mobile device.
* The login name is composed of the user that is authenticating separated with the user to be
* impersonated with a single '!', like
* impersonated-user@test.com!auth-user@domain.com
*
* When the imersonated and auth user are in the same domain, you can use
* impersonated-user!auth-user@domain.com
*
* The password is of course of the authenticating user.
* Full store permissions are required for the mobile to sync correctly.
*/
define('ALLOW_IMPERSONATE', false);
