ehlo,
The MSFT docs [1,2] for LDAP attributes says:
samAccountName is mandotory for 'user' and 'group' objectclasses
via the 'Security-Principal' aux-class
name is part of the 'top' class and *not* mandatory for 'user' or
'group'.
Attached patch should fix #2593.
LS
[1]
https://msdn.microsoft.com/en-us/library/ms679635%28v=vs.85%29.aspx
[2]
https://msdn.microsoft.com/en-us/library/ms678697%28v=vs.85%29.aspx