This relies on the ohai plugin being enabled.  https://wiki.opscode.com/display/chef/Disabling+Ohai+Plugins
If you are using LDAP, it is assumed that you have an alternate mechanism for controlling users going into LDAP.  I was thinking that the scope should be limited to local users.  For that, although slightly yuck, parsing /etc/passwd is probably the way to go and collecting an array of Struct::Passwd and then filter using that data, i.e.

filter {|u| u.uid < 500 }