Why a separate user for LDAP bind, why not bind with the user-supplied u+p?

[bluikko]

Is there a reason why LoginLdap requires a separate user+password for LDAP bind, instead of binding as the user+password that the user supplied when attempting to login?

[kkugelmann]

Using the supplied username+password might be reasonable when logging into the backend. To import new LDAP users as an admin there has to be a bind user, as you're only inserting the username of the new user.

[serverhorror]

That is not entirely true.

It depends on the configuration of the LDAP server, specifically AD is preconfigured to accept things like the UPN (userPrincipalName) and samAccountName and not a DN