Intent to backport OAK-7428 to 1.8/1.6/1.4

[Manfred Baedke]

Hi,

This fix allows external identifiers for LDAP principals to be created 
from custom attributes, not just from the LDAP DN. Since the DN may 
change and rep:externalId is a protected property, this is necessary.

Best regards,
Manfred