dovecot: reintroduce LDAP bind auth for passdb

LDAP bind auth used to be enabled by default (and not configurable)
before the dovecot 2.4 migration.

I changed the default option value to match the old Dovecot 2.3
behavior.

The use of authentication bind is required for LDAP servers that simply
do not have such LDAP attribute like Kanidm, or in cases where the
password scheme used is not supported by Dovecot.

tests/ldap.nix

@@ -25,7 +25,7 @@ in
 
   nodes = {
     machine =
-      { pkgs, ... }:
+      { pkgs, lib, ... }:
       {
         imports = [
           ../default.nix
@@ -166,12 +166,51 @@ in
             };
             base = "ou=users,dc=example";
             scope = "sub";
+            attributes = {
+              # disable auth bind
+              password = "userPassword";
+            };
           };
 
           forwards = {
             "bob_fw@example.com" = "bob@example.com";
           };
         };
+
+        specialisation.auth_bind = {
+          inheritParentConfig = true;
+          configuration = {
+            mailserver = {
+              ldap = {
+                attributes = {
+                  # enable auth bind
+                  password = lib.mkForce null;
+                };
+              };
+            };
+
+            services.openldap.settings.children = {
+              "olcDatabase={1}mdb" = {
+                attrs = {
+                  olcAccess = [
+                    # disallow access to userPassword
+                    ''
+                      to * attrs=userPassword
+                        by anonymous auth
+                        by * none
+                    ''
+
+                    # default policy (same as if we would specify none as all)
+                    ''
+                      to *
+                        by * read
+                    ''
+                  ];
+                };
+              };
+            };
+          };
+        };
       };
   };
   testScript =
@@ -331,5 +370,10 @@ in
           "--dst-password-file <(echo '${malloryPassword}')",
           "--ignore-dkim-spf"
         ]))
+
+      with subtest("LDAP Authentication Binds"):
+        machine.succeed("/run/booted-system/specialisation/auth_bind/bin/switch-to-configuration test")
+        machine.wait_for_unit("openldap.service")
+        machine.succeed("doveadm auth test alice '${alicePassword}'")
     '';
 }