Just to follow up on this - many thanks for the replies and I was able to get this working with the assistance above.
Here are a couple of notes from what I found. When authenticating against AD, I use a username, such as 12345 (from the usersearch) and a first name/last name mapped to CN as the username_attribute.
In the ldap users above, I have to specify the CN as the list of users, so “My Name”, rather than 12345.
Hope this helps someone else.