People Picker for AD LDS FBA

Question

I have set up a test system to evaluate the use of AD LDS in an extranet scenario. I have a Windows 2008 R2 server with Sharepoint 2010 SP1 installed. This machine is joined to an AD domain, and has the AD LDS role enabled. I have created a claims based auth site, supporting both windows auth and forms. I have configured the providers as follows:

Central Admin

<roleManager defaultProvider="AspNetWindowsTokenRoleProvider" enabled="true" cacheRolesInCookie="false">
  <providers>
  </providers>
</roleManager>
<membership defaultProvider="LdapMember">
  <providers>
    <add name="LdapMember" type="Microsoft.Office.Server.Security.LdapMembershipProvider,&#xD;&#xA; Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral,&#xD;&#xA; PublicKeyToken=71e9bce111e9429c" server="localhost" port="6000" useSSL="false" userDNAttribute="distinguishedName" userNameAttribute="cn" userContainer="CN=Users,CN=FAPartition,DC=sharepointpoc,DC=COM" userObjectClass="user" userFilter="(ObjectClass=user)" scope="Subtree" otherRequiredUserAttributes="cn" />
  </providers>
</membership>

STS

<roleManager defaultProvider="c" enabled="true" cacheRolesInCookie="false">
  <providers>
    <add name="c" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthRoleProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
  </providers>
</roleManager>
<membership defaultProvider="LdapMember">
  <providers>
    <add name="i" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthMembershipProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
    <add name="LdapMember" type="Microsoft.Office.Server.Security.LdapMembershipProvider,&#xD;&#xA; Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral,&#xD;&#xA; PublicKeyToken=71e9bce111e9429c" server="localhost" port="6000" useSSL="false" userDNAttribute="distinguishedName" userNameAttribute="cn" userContainer="CN=Users,CN=FAPartition,DC=sharepointpoc,DC=COM" userObjectClass="user" userFilter="(ObjectClass=user)" scope="Subtree" otherRequiredUserAttributes="cn" />
  </providers>
</membership>

FBA Application

<membership defaultProvider="i">
      <providers>
        <add name="i" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthMembershipProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
        <add name="LdapMember" type="Microsoft.Office.Server.Security.LdapMembershipProvider,&#xD;&#xA; Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral,&#xD;&#xA; PublicKeyToken=71e9bce111e9429c" server="localhost" port="6000" useSSL="false" userDNAttribute="distinguishedName" userNameAttribute="cn" userContainer="CN=Users,CN=FAPartition,DC=sharepointpoc,DC=COM" userObjectClass="user" userFilter="(ObjectClass=user)" scope="Subtree" otherRequiredUserAttributes="cn" />
      </providers>
    </membership>
    <roleManager defaultProvider="c" enabled="true" cacheRolesInCookie="false">
      <providers>
        <add name="c" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthRoleProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
      </providers>
    </roleManager>

I have also added the wildcard configuration into the central admin config file

<PeoplePickerWildcards>
   <clear />
   <add key="AspNetSqlMembershipProvider" value="%" />
   <add key="LdapMember" value="*"/>
</PeoplePickerWildcards>

I have added my SharePoint service account to the Readers role in LDS, and am able to connect using the service account credentials through ADSI Edit.

No LDS users appear in the people picker, only AD domain users.

I am able to log in using an account in AD LDS, but just get access denied because I cannot assign rights to the user.