### Steps to reproduce

1. Begin of the insertion End of the insertion On first install, seed an LDAP auth source from env vars: `OPENPROJECT_SEED_LDAP_<name>_<key>`. Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion 2. Begin of the insertion End of the insertion Use keys following the usual `OPENPROJECT_*` double-underscore convention (e.g. `..._TLS__MODE`, `..._ACCOUNT`, `..._BASE__DN`) and single-underscore mapping keys (e.g. `..._LOGIN_MAPPING`). Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion 3. Begin of the insertion End of the insertion Run the seeder (`db:seed`). Begin of the insertion


End of the insertion Begin of the deletion

End of the deletion ### What is the buggy behavior?

Begin of the insertion* End of the insertion Begin of the deletion -End of the deletion Keys not matching the **literal options-hash name** are silently ignored: Begin of the insertion

* End of the insertion Begin of the deletion
-End of the deletion `..._TLS__MODE` ignored → seeder fails with Begin of the insertion**&quot;TLSEnd of the insertion Begin of the deletion **"TLSEnd of the deletion mode is invalid or Begin of the insertionmissing&quot;**End of the insertion Begin of the deletion missing"**End of the deletion (the correct key is `SECURITY`). Begin of the insertion

* End of the insertion Begin of the deletion
-End of the deletion `..._LOGIN_MAPPING` (single underscore) → `options["login_mapping"]` is nil → Begin of the insertion**&quot;UsernameEnd of the insertion Begin of the deletion **"UsernameEnd of the deletion attribute Begin of the insertioncan&#39;tEnd of the insertion Begin of the deletion can'tEnd of the deletion be Begin of the insertionblank&quot;**End of the insertion Begin of the deletion blank"**End of the deletion (must be `LOGIN__MAPPING`, doubled). Begin of the insertion

* End of the insertion Begin of the deletion
-End of the deletion The convention is undocumented and internally inconsistent: single-token keys stay single (`BINDUSER`, `BINDPASSWORD`, `BASEDN`, `SECURITY`), but underscore-bearing keys must be doubled (`LOGIN__MAPPING`, `TLS__VERIFY`). `..._NAME` is a silent no-op. Begin of the insertion


End of the insertion Begin of the deletion

End of the deletion ### What is the expected behavior?

Begin of the insertion* End of the insertion Begin of the deletion -End of the deletion Document the exact keys (`BINDUSER`, `BINDPASSWORD`, `BASEDN`, `SECURITY`, `TLS_VERIFY`, `*_MAPPING`) and the single-vs-double-underscore rule; validate/warn on unknown keys at seed time instead of silently ignoring them; ideally accept intuitive aliases (`ACCOUNT`, `BASE__DN`, `TLS__MODE`, …). Begin of the insertion


End of the insertion Begin of the deletion

End of the deletion ### Root cause / proposed fix

Begin of the insertion* End of the insertion Begin of the deletion -End of the deletion `LdapSeeder` reads `Setting.seed_ldap[<name>][<key>]` where `<key>` is the literal options-hash key, while the env-var → nested-hash parser splits the nested portion on single underscores. Verified against v17.4.0 `app/seeders/env_data/ldap_seeder.rb`. Begin of the insertion

* The LDAP seeder should run a test connection, and output warning if the connection cannot be established


End of the insertion Begin of the deletion

End of the deletion ### Logs

Begin of the insertion```textEnd of the insertion Begin of the deletion ```End of the deletion
TLS mode is invalid or missing
Username attribute can't be blank
```

### Environment information

**OpenProject installation type** Begin of the insertion

* End of the insertion Begin of the deletion
-End of the deletion [x] Other (please specify): **Kubernetes — official OpenProject Helm chart (opf/helm-charts 13.5.1), deployed via ArgoCD on EC DIGIT CaaS (private cloud)**

**OpenProject version** Begin of the insertion
End of the insertion Begin of the deletion
End of the deletion v17.3.1 (chart 13.5.1). Verified still present on v17.4.0.

**Browser** Begin of the insertion

* End of the insertion Begin of the deletion
-End of the deletion [x] Other (please specify): **N/A — server-side (seeder)**

**Operating System** Begin of the insertion

* End of the insertion Begin of the deletion
-End of the deletion [x] Linux (please specify distro): **Debian (OpenProject slim container base), on Kubernetes**

**Language** Begin of the insertion
End of the insertion Begin of the deletion
End of the deletion Browser English (en); OpenProject user language English.