Bind operation with empty password doesn't throw exception

[aleksvujic]

We are using .NET 7 and Novell.Directory.Ldap.NETStandard 3.6.0. We have the following code snippet for validating username and password against an LDAP server:

try
{
  using (var connection = new LdapConnection(ldapOptions) { SecureSocketLayer = true, ConnectionTimeout = timeoutMs })
  {
    connection.Connect(ldapServer.Url, ldapServer.Port);

    _logger.LogInformation($"Connection to LDAP server {ldapServer} succeeded");

    connection.Bind(usernameWithDomain, string.Empty);

    if (connection.Bound)
    {
      _logger.LogInformation($"User {usernameWithDomain} LDAP bind successfull (Password verification passed).");
      return PasswordVerificationResultExtended.Success;
    }
  }
}
catch (LdapException ex)
{
  if (ex.ResultCode == LdapException.ServerDown || ex.ResultCode == LdapException.ConnectError)
  {
    _logger.LogError($"Error during LDAP connect/bind! User={usernameWithDomain}, Server={ldapServer}, Error={ex.Message}");
    return PasswordVerificationResultExtended.Failed;
  }
  else if (ex.ResultCode == LdapException.InvalidCredentials)
  {
    _logger.LogError($"Username {usernameWithDomain} and password don't match!");
    return PasswordVerificationResultExtended.Failed;
  }
  else
  {
    _logger.LogError($"Error during LDAP connect/bind! User={usernameWithDomain}, Server={ldapServer}, Error={ex.Message}");
    return PasswordVerificationResultExtended.Failed;
  }
}
catch (Exception ex)
{
  _logger.LogError($"Error during LDAP connect/bind! User={usernameWithDomain}, Server={ldapServer}, Error={ex.Message}");
  return PasswordVerificationResultExtended.Failed;
}

Pay attention to the connection.Bind(usernameWithDomain, string.Empty); line. I would expect that an exception with LdapException.InvalidCredentials result code would be thrown in such case. Instead, only connection.Bound field is set to false.

Is this a bug?

[klasen]

Zero length passwords are used in Unauthenticated Simple Binds:
https://www.rfc-editor.org/rfc/rfc4513#section-5.1.2