I know this is a bit of a necro, but we ran into this with AD authentication in v15 and 16, and the fix was, as chrissi55 suggested, to use expert mode. Rather than using cn as the value, we selected sAMAccountName. This matched user names exactly to AD.
We also cleared the mapping and that brought all users in-line with the new settings.
