We recently upgraded from 3.8+ (Build: 20191122) to 3.8.6+ (Build: 20201224) and on the first run of the Moodle cron job noticed that LDAP system role mapping was broken - managers and course creators were removed from the system roles.

On investigation, it seems this is down to a change in the auth_ldap | memberattribute_isdn setting. This used to be a text field that could be left blank, but it's now a picklist and requires being set to yes or no. 

The instructions for this setting say:

Whether the member attribute contains distinguished names (1) or not (0).This option takes a default value based on the User type value you choosed above. So unless you need something special, you don't need to fill this in.

++Checking the database backup from before we upgraded, this setting was set to an empty string. Post the upgrade, it was set to '0'.

Our 'User type' is set to 'MS ActiveDirectory' and it appears MS AD does indeed use DNs in the member attribute. When this setting was blank, it appears Moodle 'knew' this from the 'User type' and filtered according. But with this change, you're now required to explicitly set this, rather than allowing Moodle to dynamically decide based on the user type.

It would seem the auth_ldap | memberattribute_isdn setting should be allowed to be left blank, so Moodle can decide for itself based on the selected 'User type' whether the member attribute contains DNs.