See discussion on: https://gitlab.com/samba-team/samba/-/merge_requests/1402 Currently net-ads-join doesn't work due to hardcoded sasl sealing, fix that by implicitly disabling sasl sign/seal when over TLS (so the admin no longer needs to explicitly set sasl-wrapping to plain). Also decouple "ldap ssl ads" from "ldap ssl", as there is no real dependency.