|No such thing as a small change
The typical process for testing authentication in LDAP is:
It seems like it's a lot of work -- eg, you could just form the DN from the uid and the base, but this prevents you from being able to handle hierarchies in your tree. (eg, you might have 2 groups of accounts under different OUs). You also can't read the userPassword attribute unless you're either bound as that user, or you give your application user extra access ... which is dangerous. You'd also have to parse the userPassword, which could be:
As the password encryption is done when the password's written, it's entirely possible for there to be more than one type of encryption used in the LDAP server. (including plaintext passwords, which is all the more reason to not have application users able to read the attribute directly). Every time toy upgrade your LDAP server, you'd have the change of it using a new encryption, and your authentication checks suddenly failing if you're attempting to parse userPasssword.