By default LDAP Authorization should use a query which locks onto entities by userPrincipalName and acquires their memberOf attribute. Most users of this feature will probably be using AD, and we should make the default query conform to this.