StartTLS vs SSL?

[Derp Niner]

Hello,

I am interested to learn what is the recommended configuration for
securely communicating with an ldap server. Looking at the example
settings in conf/ldap.properties it appears that StartTLS is
preferred. This is also supported by the very brief explanation here:
http://www.openldap.org/faq/data/cache/605.html

I have a shallow understanding of most of the things to consider while
configuring the IdP. In this case I am looking for what is considered
best practice so that I can move forward with standing up a test
instance of the IdP.

I am using IdP v3.1.0 on a non-windows server and the ldap server is
provided by a windows domain controller. Both of the below
configurations work (testing with sp.testshib.org). I would like to
know which one is preferred (and why if you have a few minutes to
explain).

idp.authn.LDAP.authenticator                   = adAuthenticator
idp.authn.LDAP.ldapURL                         = ldap://server.example.com
idp.authn.LDAP.useStartTLS                     = true
idp.authn.LDAP.useSSL                          = false
idp.authn.LDAP.connectTimeout                  = 3000

idp.authn.LDAP.authenticator                   = adAuthenticator
idp.authn.LDAP.ldapURL                         = ldaps://server.example.com
idp.authn.LDAP.useStartTLS                     = false
idp.authn.LDAP.useSSL                          = true
idp.authn.LDAP.connectTimeout                  = 3000

Thank you!