After further research it appears that if LDAP is set up for anonymous access then a blank password will return TRUE. See the first user comment at http://www.php.net/manual/en/function.ldap-bind.php

This is the work around I used (as I don't allow anonymous access to Mantis):

*** ldap_api.php.orig Wed Apr 16 14:18:37 2003
--- ldap_api.php Fri Apr 11 16:36:43 2003

* 124,129 **
--- 124,133 ----
ldap_free_result( $t_sr );
ldap_unbind( $t_ds );

• if ( is_blank( $p_password )) {
• $t_authenticated = false;
• }

• return $t_authenticated;

  }

For 0.19.0a1 I've solved the problem with this patch:

*** ldap_api.php.orig Fri Jul 16 20:30:08 2004
--- ldap_api.php Fri Jul 16 20:31:03 2004

* 99,104 **
--- 99,110 ----
$t_ldap_organization = config_get( 'ldap_organization' );
$t_ldap_root_dn = config_get( 'ldap_root_dn' );

• if ( is_blank( $p_user_id ) || is_blank( $p_password ) ) {
• $t_authenticated = false;
• return $t_authenticated;
• }

•         $t_username             = user_get_field( $p_user_id, 'username' );
          $t_search_filter        = "(&$t_ldap_organization(uid=$t_username))";
          $t_search_attrs         = array( 'uid', 'dn' );