external LDAP's, really? in most cases your LDAP will be an AD domain controller, and in this case set the cert username logic in the AD, but NOT query the AD

external LDAP's, really? in most cases your LDAP will be an AD domain controller, and in this case set the cert username logic in the AD, but NOT query the AD by yourself.