There has never been any LDAP support for doing queries for data in the SP, it only supports SAML attribute queries. https://wiki.shibboleth.net/confluence/display/SP3/SimpleAggregationAttributeResolver -- Scott