When a user needs to use the web configurator, import the the user from the remote ldap server using "import users" on system_usermanager.php
For backward compatibility purposes ldap_backed still can authenticate without a local user, although the web config isn't usable then.
(this always costs an extra query to determine the distinguished name of the user)
We may need to consider if "authenticate only" should be a bit more explicit to the user, or choose to always import users into OPNsense....