LDAP (AD) finds/creates user but user cannot log in

I have SuiteCRM 8.4.1connected to Active Directory via LDAP. I can see through WireShark that the connection is good and it returns expected info when the login is correct vs incorrect. When the login is correct, SuiteCRM creates the user, but that user only gets “Invalid credentials” when trying to log in.

Here is my LDAP setup from .env.local:
DATABASE_URL=“mysql://lvcrm:[-redacted-]@[-redacted-]/live_suitecrm”
external_auth_only=0
AUTH_TYPE=ldap
###> LDAP CONFIG ###
LDAP_HOST=‘10.2.6.21’
LDAP_PORT=3268
LDAP_ENCRYPTION=none
LDAP_PROTOCOL_VERSION=3
LDAP_REFERRALS=false
LDAP_AUTO_CREATE=enabled
LDAP_DN_STRING=‘CN=crm,DC=ny,DC=millenniumweb,DC=com’
LDAP_QUERY_STRING=‘objectClass=person’
LDAP_SEARCH_DN=‘NY\sqladmin’
LDAP_SEARCH_PASSWORD=‘[-redacted-]’
LDAP_PROVIDER_BASE_DN=‘DC=ny,DC=millenniumweb,DC=com’
LDAP_PROVIDER_DEFAULT_ROLES=ROLE_USER
LDAP_PROVIDER_SEARCH_DN=‘NY\sqladmin’
LDAP_PROVIDER_SEARCH_PASSWORD=‘[-redacted-]’
LDAP_PROVIDER_UID_KEY=‘sAMAccountName’
LDAP_PROVIDER_FILTER=‘sAMAccountName={username}’
###< LDAP CONFIG ###

Please help!