In retrospect, the original behavior was a bit odd. I'm not sure, however, whether you new proposed behaviour isn't also somewhat odd.

Wouldn't it be better to just leave lists as lists, and single values as single values? This would also be a backwards-incompatible change, but one that would leave data in the form sent by the LDAP server rather than applying arbitrary rules to coerce it to single values or lists.

Either case works, the reason I went with this solution is because this solution breaks backwards compatibility slightly less. I'd imagine in most LDAP databases, each field that you'd want to transfer to Django only has a single value as expected in a custom clean_user_data which means that those would not break. But it really just leaves a hole if someone were to accidentally add a second value to a field in LDAP and suddenly break it.

As you say, either solution would break backwards compatibility, but your solution would at least force someone to account for it instead of possibly silently failing.

Can we go with my suggestion of leaving the server data as-is? A breaking change is fine, they happen sometimes.

Can we go with my suggestion of leaving the server data as-is?

Fine with me, I just want all LDAP data to be preserved.