Require 2FA for non bind LDAP accounts

When creating a LDAP flow you have to auth with a bind account for LDAP querying which is fine and 2FA wouldn't be wanted here, but how do I force 2FA for the other accounts?

Start by tracing the LDAP flow and how it distinguishes the bind account from other accounts, then inspect the existing 2FA enforcement configuration. The issue is done when the supported configuration or behavior for requiring 2FA on non-bind LDAP accounts is defined and verified.

Written by the indexing model from the issue text.