When a user or group name filter is too general, it will return LDAP entities that don't have the required fields. These should be warned about (since we're visiting more LDAP entities than we probably should, and that will make the sync slower), and then filtered out, as if they were part of the existing filter.

They should not result in a fatal log message that prevents the sync from completing.