Can't get LDAP to work

We run XWiki 17.10.13 (LTS) with Java 21, Tomcat 11, and PostgreSQL 18, and we want to connect users to Microsoft Active Directory via LDAP. The extension “LDAP Authenticator” (org.xwiki.contrib.ldap:ldap-authenticator) version 9.16.6 is only built for XWiki 10.11. The dependency check in the Extension Manager shows a mismatch with 17.10.13. When we enable the LDAP service, the local admin is locked out (“LDAP authentication failed”), with no fallback to local accounts, even though trylocal=1 is set.

Any ideas what elst to try?