Support GSSAPI/SASL binds for LDAP user backend

How to use GitHub

• Please use the 👍 reaction to show that you are interested into the same feature.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

Is your feature request related to a problem? Please describe.
I'm using Nextcloud in an Kerberized environment where all hosts and services have their own principals, including nextcloud at HTTP/<fqdn>@REALM. I'm currently unable to use this principal with system tickets to authenticate the Nextcloud server against LDAP using SASL.

Describe the solution you'd like
I'd like there to be an option to use SASL for authenticating the Nextcloud server against an LDAP backend, preferably with support for the added security layers provided with Kerberos and the like.

Describe alternatives you've considered
Regular old bind with LDAPS.

Additional context

• https://www.php.net/manual/en/function.ldap-sasl-bind.php

Start by locating the Nextcloud LDAP user backend and its existing bind or authentication entry points, then read PHP's ldap_sasl_bind documentation linked in the issue. The work is done when the backend can be configured to authenticate with SASL, including the requested Kerberos-related security layers, with its behavior verified by appropriate tests.