Once external group sync is setup through AD LDAPS, which works, but doesn't seem to work as intended, because it doesn't create groups or sync permissions assigned to those external groups via roles, more importantly I stopped debugging the issue because when this feature was enabled, importing puppet classes and importing environments failed. I'll add the debug messages later, because my production instance is no longer available for experimentation.