support connect ldap server with starttls (#5969)

* support connect ldap server with starttls

* add more doc for start_tls option

pkg/login/ldap.go

@@ -48,7 +48,16 @@ func (a *ldapAuther) Dial() error {
 				ServerName:         host,
 				RootCAs:            certPool,
 			}
-			a.conn, err = ldap.DialTLS("tcp", address, tlsCfg)
+			if a.server.StartTLS {
+				a.conn, err = ldap.Dial("tcp", address)
+				if err == nil {
+					if err = a.conn.StartTLS(tlsCfg); err == nil {
+						return nil
+					}
+				}
+			} else {
+				a.conn, err = ldap.DialTLS("tcp", address, tlsCfg)
+			}
 		} else {
 			a.conn, err = ldap.Dial("tcp", address)
 		}

pkg/login/settings.go

@@ -19,6 +19,7 @@ type LdapServerConf struct {
 	Host          string           `toml:"host"`
 	Port          int              `toml:"port"`
 	UseSSL        bool             `toml:"use_ssl"`
+	StartTLS      bool             `toml:"start_tls"`
 	SkipVerifySSL bool             `toml:"ssl_skip_verify"`
 	RootCACert    string           `toml:"root_ca_cert"`
 	BindDN        string           `toml:"bind_dn"`