}

	// Round the request time *down* to whole minute.
	reqTimeMinute := reqStartTime.Truncate(time.Minute)
	if reqTimeMinute.After(h.currentMinute.statsTime) {
		// Drop the last full minute now, since we got a request for a time we
		// are not yet tracking.
		h.updateLastFullMinute(reqTimeMinute)
	}
	var entry *serviceRTTMinuteStats
	switch {
	case reqTimeMinute.Equal(h.currentMinute.statsTime):
		entry = &h.currentMinute

	}

	if err := s.CheckValidKeys(config.IdentityLDAPSubSys, removedKeys); err != nil {
		return l, err
	}

	getCfgVal := func(cfgParam string) string {
		// As parameters are already validated, we skip checking
		// if the config param was found.
		val, _, _ := s.ResolveConfigParam(config.IdentityLDAPSubSys, config.Default, cfgParam, false)
		return val
	}

	ldapServer := getCfgVal(ServerAddr)

	// Comments usually are absent from `defKVS`, so we handle it specially.
	if !isFound && cfgParam == Comment {
		defValue, isFound = "", true
	}
	if !isFound {
		return
	}

	if target == "" {
		target = Default
	}

	if redactSecrets {
		// If the configuration parameter is a secret, make sure to redact it when
		// we return.
		helpKV, _ := HelpSubSysMap[subSys].Lookup(cfgParam)