anonymous bind + user bind + password hash

Our openLdap server always requires binding with an account. It will fail with an anonymous bind. Thus, we have a technical user and password with which we bind and execute searches.

Our LDAP will not ever release a password (even as hash), thus I cannot use that field to verify the user's password. Instead, I have to bind to LDAP using the user's password ,

So, in order to verify a user's password, I need to:
connect
start TLS
bind with the technical user
fetch the user's record (we have special attributes with which we can search for either the shortname (uid) or the email address)
then use the cn of that record to rebind using the user's password.

If the last step succeeds, I have the correct password, otherwise not.

LDAP modules of other applications (i.e. RT4) offer this option, this one doesn't. Could this be implemented?
Implementing startTLS is easy, it only requires calling the ldap_start_tls function and checking for a true or false. (Of course there's more to it, but not on the programming side.) We'd need some configuration flag to use or not use TLS, though.

Start by tracing the plugin's existing LDAP authentication and configuration flow; the issue identifies the required LDAP operations as connect, optional ldap_start_tls, technical-user bind, user lookup, and password rebind. Confirm the current entry points and test coverage before deciding how the option fits. Done means configured LDAP servers can complete this sequence and reject incorrect user passwords without retrieving a password hash.