Look for this part of the ROOT.xml file:
<Parameter description="The name of the Code Collaborator system administrator who is always allowed to log in. " name="system-administrator" override="false" value="admin"/>
(In other words, the value of that Parameter tag is the admin that is being referred to above.)
For ldap, either you'd need an "admin" user to match the ROOT.xml declaration above, or change the above to match the login of an administrative user you already have defined in ldap. In other words, the system does password auth against LDAP as normal, but if the login matches that ROOT.xml declaration, they're exempted from license checks.