Your comments

Nice, thanks for the great level of follow-up!

Update after some more testing: even with the LDAP proxy adjusted and not 2FA enabled, the 'use SSO button' message appears. 
The LDAP proxy is based on OpenLDAP and is configured to listen on a non-standard port (i.e. not 389 or 636), but I cannot find any suggestion that either of these characteristics are meant to trigger the message, but maybe I overlooked something?

I think it is justified to state that the LDAP proxy behaves as a normal LDAP server: it is confirmed to be working as expected (both with and without 2FA enabled) with other self-hosted apps that use LDAP authentication, such as Organizr, Subsonic and Jellyfin.

I concur: although I am aware there is the option from within the Filerun WebUi to re-index individual folders, it would be nice to have the option to scan for new files first and subsequently re-index only those...