Interesting bug, not sure if it's an issue past 2.x version, but [in Grouper External Systems for external system type of LDAP] selecting TLS (as default) doesn't work, TLS set to "True" must be selected. In case this is helpful for anyone else out there.