Fundamentally you need a password in a sealed envelope in a safe in the ops area, so when LDAP is in a hopeless situation, a field tech can be talked over the p

Fundamentally you need a password in a sealed envelope in a safe in the ops area, so when LDAP is in a hopeless situation, a field tech can be talked over the phone into logging in as root using the sealed envelope to access a new LDAP server, or something. Also its "easy" to set up insecure ldap or more precisely its easy to not deny insecure ldap connections, but its hard to mess up something like Kerberos to be overly permissive... But it doesn't matter, it just changes the scenario to "kerberos is dead for whatever reason, need root login to fix".