From 6ef15490221f6a7f17125a97f93a021c046329cf Mon Sep 17 00:00:00 2001
From: nv6 <73319848+nv6@users.noreply.github.com>
Date: Tue, 7 Jul 2026 22:13:50 -0400
Subject: [PATCH] feat: try anonymous bind when credentials unset

When BindDN and bindPw are empty, attempt unauthenticated bind (normal bind crashes with code 206). This allows connecting to
LDAP servers that support anonymous access without requiring authentication.
---
 internal/service/ldap_service.go | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/internal/service/ldap_service.go b/internal/service/ldap_service.go
index 60dd6bee9..3c31bab72 100644
--- a/internal/service/ldap_service.go
+++ b/internal/service/ldap_service.go
@@ -246,6 +246,12 @@ func (ldap *LdapService) BindService(rebind bool) error {
 	if ldap.cert != nil {
 		return ldap.conn.ExternalBind()
 	}
+
+	// attempt unauthenticated/anonymous bind if both BindDN and bindpw are unset
+	if ldap.config.LDAP.BindDN == "" && ldap.bindPw == "" {
+		return ldap.conn.UnauthenticatedBind("")
+	}
+
 	return ldap.conn.Bind(ldap.config.LDAP.BindDN, ldap.bindPw)
 }