Migration tool needs to be connected to the customers LDAP repository so that it can determine that a user account is linked to an external LDAP account.

Once we've determined such a user, we ought to grant them external membership rather than internal membership. (in programmatic terms, the old OSUser account should be migrated to be an AltassianUser "external user" whose membership should be recorded in the EXTERNAL_MEMBERS table).