[Sam Bauers]

The LDAP-Auth plugin does not bind anonymously, it binds as the user who is trying to log in, and it searches for that users UID in the specified domain. If your users are all in the “o=Lions” domain you specified in your search, then that should be it. Provided that they have a valid uid/password in that branch of your LDAP tree they should be able to authenticate.