NFA 9.1.x uses a different SSO Module then in earlier versions of RA or even NPC.
This means after upgrading to NFA 9.1.3 you must also update your LDAP Settings.
If you are disconnecting NFA from NPC and linking it up with CAPC, you should only need to setup LDAP on the CAPC server and the correct settings should sync down to the NFA server to allow users to login with LDAP credentials.
However if you are still linked to NPC, these settings are not 100% compatible with the new SSO Module used with NFA, so you will need to launch the new SSOConfig tool on the NFA console server and setup the LDAP settings here.
The latest version of the SSO Configuration guide can be found at the link below and Chapter 2 covers the LDAP setup.
https://support.ca.com/cadocs/1/CA%20Network%20Flow%20Analysis%209%201%203-ENU/Bookshelf_Files/PDF/capc_SSO_UserGuide_en_US.pdf
The SSOConfigtool.exe can be found in either the \CA\NFA\Portal\SSO\bin directory on new installations or the \Netqos\Portal\sso\bin directory.
Being that NPC will still sync down the settings in the database for LDAP based on the older SSO modules, you will need to setup LDAP on the NFA console server with all "Local Override" settings, which you will see as an option when launching the SSO Config tool.
The "Local Override" SSO settings will tell NFA To ignore anything from NPC that has been overridden on the NFA console server.