It works if I remove

LDAP Admin Filter

but then I'll have to set admin status for each user manually and it won't infer that from the attached groups in lldap