As we moved to a before_save callback, explicitly raise a RecordInvalid when LDAP save fails