The request makes sense, but I'm not sure it's feasible considering that LDAP requests do not only occur for authentication (i.e. at login time), but also whenever user information needs to be retrieved from the directory (e.g. email or realname, see ldap_cache_user_data() ).

So, I'm not sure how this could be implemented in a secure manner, as we would somehow need to store the user's password so it can be reused to bind whenever an LDAP query needs to be made...

Unless you have a better idea or suggestions ?

Agreed - I was pondering that too, as I was looking at the code, wondering how you'd get around passing passwords around to every and all functions, and caching it somewhere seems risky as well (as it'd need to be in a reversible "hash" or in clear text). This may not have a good (as in secure) solution. :/

Based on my analysis and your feedback, I'm resolving this as "not fixable".

Feel free to reopen if you come up with an idea that could meet the requirement in a secure manner.

Fair enough - thank you for the consideration!