From 389 Directory Server

Fedora DS v1.0.4: When trying to bind with a user with a null password, It seems the bind was successful. ( The user in the directory server does have a unique password assigned to it. )In the ensuing search for the user's attributes also succeeds even though the password sent to the fedora ds is null. Not sure if it is my setup for the directory server or if it's a bug in fedora DS. Working with Active Directory (windows) LDAP, it works fine, since sending a null password results in a ldap error.

LDAPv3 says that binding with a null password is the same as an anonymous bind. I think AD by default disallows anonymous bind. There is a feature on the roadmap to disallow anonymous bind.--Rich Megginson 10:11, 3 November 2008 (EST)