LDAP: finishing touches (#17945)

* LDAP:Docs: `active_sync_enabled` setting

Mention `active_sync_enabled` setting and enable it by default

* LDAP: move "disableExternalUser" method

Idea behind new design of the LDAP module is to minimise conflation
between other parts of the system, so it would decoupled as much as
possible from stuff like database, HTTP transport and etc.

Following "Do One Thing and Do It Well" Unix philosophy principal, other things
could be better fitted on the consumer side of things.

Which what this commit trying to archive

* LDAP: correct user/admin binding

The second binding was not happening, so if the admin login/password
in LDAP configuration was correct, anyone could had login as anyone using
incorrect password

pkg/services/ldap/testing.go

@@ -19,14 +19,19 @@ type MockConnection struct {
 	DelParams *ldap.DelRequest
 	DelCalled bool
 
-	bindProvider                func(username, password string) error
-	unauthenticatedBindProvider func(username string) error
+	UnauthenticatedBindCalled bool
+	BindCalled                bool
+
+	BindProvider                func(username, password string) error
+	UnauthenticatedBindProvider func() error
 }
 
 // Bind mocks Bind connection function
 func (c *MockConnection) Bind(username, password string) error {
-	if c.bindProvider != nil {
-		return c.bindProvider(username, password)
+	c.BindCalled = true
+
+	if c.BindProvider != nil {
+		return c.BindProvider(username, password)
 	}
 
 	return nil
@@ -34,8 +39,10 @@ func (c *MockConnection) Bind(username, password string) error {
 
 // UnauthenticatedBind mocks UnauthenticatedBind connection function
 func (c *MockConnection) UnauthenticatedBind(username string) error {
-	if c.unauthenticatedBindProvider != nil {
-		return c.unauthenticatedBindProvider(username)
+	c.UnauthenticatedBindCalled = true
+
+	if c.UnauthenticatedBindProvider != nil {
+		return c.UnauthenticatedBindProvider()
 	}
 
 	return nil