fix(ldap): Support client certificate authentication without fallback to anonymous bind

[crafa2]

Overview

This PR fixes an issue where Dex incorrectly drops client certificates before performing an LDAP bind, leading to unintended anonymous authentication instead of certificate-based authentication.

What this PR does / why we need it

• Ensures that if a client certificate is provided, Dex does not perform an anonymous bind that could override the certificate-based authentication.
• Simplifies the binding logic to make it more readable and maintainable.
• Addresses cases where bindDN and bindPW are empty while a certificate is provided.

Closes #<4025>.

Special notes for your reviewer

• This change assumes that if a client certificate is provided, it should take precedence over an anonymous or credential-based bind.
• The updated logic ensures that Dex behaves consistently when handling different authentication methods.
• Let us know if additional tests are required to validate different LDAP configurations.

[nabokihms]

Is this a breaking change? We probably need a new test to cover this case.

[crafa2]

This change should not be a breaking change for existing configurations because it only modifies behavior when a client certificate is explicitly provided and no bindDN/bindPW is set.

• If no certificate is provided, Dex continues to behave as before:

  • If bindDN and bindPW are set → Dex performs a credential-based bind.
  • If bindDN and bindPW are empty → Dex falls back to an anonymous bind.

• If a certificate is provided:

  • If bindDN and bindPW are also set, Dex still performs the credential-based bind, keeping the previous behavior.
  • If bindDN and bindPW are empty, Dex now uses the certificate authentication instead of falling back to an anonymous bind (which was unintended behavior before).

So effectively, this fix just ensures that when a client certificate is used, it actually gets used for authentication instead of being dropped.