more intelligent negative cache in LdapUser plugin

[vladak]

from @tulinkry:

I am late to the party. Looks good, I only worry when someone configures tomcat to have longer sessions (like day long). There is no mechanism to retry the ldap lookup in a shorter period.

I'd rather much see storing like a timestamp of last fetch and then retrying only after 30 minutes (can be configurable in the plugin) internally in the plugin, as opposed to expecting tomcat to have sane session expiration.

Originally posted by @tulinkry in #3860 (review)