feat: try anonymous bind when bind credentials are empty

[nv6]

Allow anonymous bind (i.e. unauthenticated) when the bind username and password aren't provided, to support LDAP servers which allow anonymous access, e.g. for directory lookups. This avoids a fatal error which currently occurs when attempting an anonymous bind:

WRN internal/bootstrap/service_bootstrap.go:35 > Failed to setup LDAP service, starting without it
error="failed to connect to LDAP server: LDAP Result Code 206 \"Empty password not allowed by the
client\": ldap: empty password not allowed by the client" log_stream=app

Summary by CodeRabbit

• Bug Fixes
  • Improved LDAP sign-in behavior when no bind credentials are provided, allowing anonymous authentication in supported environments.
  • Existing certificate-based LDAP connections continue to work as before.

[coderabbitai]

📝 Walkthrough

Walkthrough

The BindService function in the LDAP service now checks whether both BindDN and the derived bind password are empty. When true, it performs an unauthenticated LDAP bind instead of the standard authenticated bind, leaving the existing mTLS/external-bind path unchanged.

Changes

LDAP Bind Flow

Layer / File(s)	Summary
Anonymous bind support internal/service/ldap_service.go	BindService now detects when BindDN and bindPw are both empty and calls UnauthenticatedBind("") instead of the standard authenticated bind.

Estimated code review effort: 2 (Simple) | ~10 minutes

Related PRs: None identified from the provided context.

Suggested labels: ldap, bug-fix

Suggested reviewers: None identified from the provided context.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: falling back to an anonymous LDAP bind when credentials are empty.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/service/ldap_service.go`:
- Around line 249-255: The anonymous bind branch in ldap_service.go can hide a
bind password file read failure because ldap.bindPw may be empty when
utils.GetSecret fails, causing UnauthenticatedBind("") to run silently. Update
the LDAP bind setup around ldap.config.LDAP.BindDN, ldap.bindPw, and
utils.GetSecret so a BindPasswordFile read error is surfaced as a warning or
returned error before falling back to anonymous bind. Keep the
UnauthenticatedBind("") path only for the intentional case where both BindDN and
bind password are truly unset.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 07907a9b-79b6-4792-b130-827585792f97

📥 Commits

Reviewing files that changed from the base of the PR and between 73cc480 and 6ef1549.

📒 Files selected for processing (1)

• internal/service/ldap_service.go

[codecov]

Codecov Report

❌ Patch coverage is 0% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/service/ldap_service.go	0.00%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!

[steveiliop56]

Thanks @nv6!