Yeah the plaintext password thing sucks but you can mitigate that with LDAPS so it talks over a secure socket. The other choice you have is to use Kerberos to

Yeah the plaintext password thing sucks but you can mitigate that with LDAPS so it talks over a secure socket. The other choice you have is to use Kerberos to do the authentication. Also, thanks for the tip about OPAQUE. Going to go check it out.