Any reason why you are not using AD for LDAP Authn? https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505688/LDAPAuthnConfiguration