When running with LDAP external user management shoudl be left off as admisn still need to create groups and manage group membership in JIRA.

However, users should to be able to change password through JIRA as the password is kept in LDAP.