From 364175adc03c4bbca5d4be26cfd4154c2dccc193 Mon Sep 17 00:00:00 2001
From: nv6 <73319848+nv6@users.noreply.github.com>
Date: Wed, 8 Jul 2026 10:11:30 -0400
Subject: [PATCH] feat: try anonymous bind when bind credentials are empty
 (#979)

---
 internal/service/ldap_service.go | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/internal/service/ldap_service.go b/internal/service/ldap_service.go
index 60dd6bee..3c31bab7 100644
--- a/internal/service/ldap_service.go
+++ b/internal/service/ldap_service.go
@@ -246,6 +246,12 @@ func (ldap *LdapService) BindService(rebind bool) error {
 	if ldap.cert != nil {
 		return ldap.conn.ExternalBind()
 	}
+
+	// attempt unauthenticated/anonymous bind if both BindDN and bindpw are unset
+	if ldap.config.LDAP.BindDN == "" && ldap.bindPw == "" {
+		return ldap.conn.UnauthenticatedBind("")
+	}
+
 	return ldap.conn.Bind(ldap.config.LDAP.BindDN, ldap.bindPw)
 }