This is required for monitoring use-cases, where we can have a Kerberos principal for a service account but no associated account in LDAP to check group membership.