From f62d74340764c7896f20530749223dc6283f0cdd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Torkel=20=C3=96degaard?= <torkel.odegaard@gmail.com>
Date: Wed, 5 Aug 2015 16:34:39 +0200
Subject: [PATCH] fix(ldap): another fix for ldap and empty bindDN and bind
 password, #2339

---
 pkg/login/ldap.go | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkg/login/ldap.go b/pkg/login/ldap.go
index 2ae4ed76539..72414bf8bab 100644
--- a/pkg/login/ldap.go
+++ b/pkg/login/ldap.go
@@ -14,8 +14,9 @@ import (
 )
 
 type ldapAuther struct {
-	server *LdapServerConf
-	conn   *ldap.Conn
+	server            *LdapServerConf
+	conn              *ldap.Conn
+	requireSecondBind bool
 }
 
 func NewLdapAuthenticator(server *LdapServerConf) *ldapAuther {
@@ -58,7 +59,7 @@ func (a *ldapAuther) login(query *LoginUserQuery) error {
 		}
 
 		// check if a second user bind is needed
-		if a.server.BindPassword != "" {
+		if a.requireSecondBind {
 			if err := a.secondBind(ldapUser, query.Password); err != nil {
 				return err
 			}
@@ -204,8 +205,9 @@ func (a *ldapAuther) secondBind(ldapUser *ldapUserInfo, userPassword string) err
 }
 
 func (a *ldapAuther) initialBind(username, userPassword string) error {
-	if a.server.BindPassword != "" {
+	if a.server.BindPassword != "" || a.server.BindDN == "" {
 		userPassword = a.server.BindPassword
+		a.requireSecondBind = true
 	}
 
 	bindPath := a.server.BindDN