c.o: ldapcivi service should not require "admin civicrm"
The ldap service for LDAP should not require the equivalent of "administer CiviCRM". The custom API calls probably do not have the correcty alterAPIPermission settings.
(I'm trying to reduce the number of roles on the site, and people/bots with admin roles)
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information