I got an answer from Rancher. See How to get right value for externalId when using LDAP - #2 by vincent.