Must the account be a Domain Admin to read active directory information to authenticate and retrieve user properties? Can I create an account with explicit permissions to do that? ...