LDAP may only be used for the loading of groups, authentication could still be by properties file or another mechanism.

Also both could be by LDAP.

From the userid entered by a user in general the first step is to search for the user to establish their distinguished name - if we already have the distinguished name from authentication it can be re-used - if not we may need to search for it again during group loading.