first snapshot, distinguishes between internal(known to LDAP) and external Shibboleth users